Compare commits

..

2 commits

Author SHA1 Message Date
Patrick Monnerat
f619425667 New upstream relase. 2020-02-09 14:26:54 +01:00
Patrick Monnerat
9e21fee3f2 Patch "bz1779029-segv" fixes a segmentation fault.
262c805
https://bugzilla.redhat.com/show_bug.cgi?id=1779029
2019-12-10 13:53:30 +01:00
5 changed files with 62 additions and 709 deletions

6
.gitignore vendored
View file

@ -11,9 +11,3 @@ xca-0.8.1.tar.gz
/xca-1.4.1.tar.gz
/xca-2.1.2.tar.gz
/xca-2.2.1.tar.gz
/xca-2.3.0.tar.gz
/xca-2.4.0.tar.gz
/xca-2.5.0.tar.gz
/xca-2.6.0.tar.gz
/xca-2.7.0.tar.gz
/xca-2.9.0.tar.gz

View file

@ -1 +1 @@
SHA512 (xca-2.9.0.tar.gz) = e635b83668d0053acb1ad5a8a20a2a1854de90a1e2a8806ecd38e83528d17bc87042d44fcea0f75f2e17df1ed135cc473449547fe273e7e3ea1fe175a4ddf054
SHA512 (xca-2.2.1.tar.gz) = 90eaf4a859779d57a4c0201dc403d67e005bd540145b9f543e13b8d5c42199f2ea05543de24b071d19a0db8e5b1e9f3bef2aea4bfe9f71f81007a5f5bb3ba406

View file

@ -1,28 +0,0 @@
When trying to use a private key when working on a database protected by
a password set by xca version < 2.0.0, version 2.5.0 and above might issue an
error like:
---
The following error occurred:
(8pki_x509[]:foo)
error:0300009C:digital envelope routines::unsupported algorithm
error:068C0100:asn1 encoding routines::malloc failure
error:068C0100:asn1 encoding routines::malloc failure
(pki_x509.cpp:574)
---
The database is therefore unusable as it is in xca 2.5.0 for any operation
involving some private key.
The solution is to reset the database password with xca version 2.4.0
(Extra --> Change Database password). The new password may be the same as
the old one.
If some private keys have their own password, reset the latter the same
way (right click --> Change password).
Once these operations have been performed, the database is ready for use with
xca version >= 2.5.
See https://github.com/chris2511/xca/discussions/468.

View file

@ -1,504 +0,0 @@
diff -Naurp xca-2.9.0.orig/lib/asn1int.cpp xca-2.9.0.new/lib/asn1int.cpp
--- xca-2.9.0.orig/lib/asn1int.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/asn1int.cpp 2026-07-21 14:50:45.138768332 +0200
@@ -10,6 +10,7 @@
#include "func_base.h"
#include "exception.h"
#include "limits.h"
+#include "openssl_compat.h"
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -67,7 +68,7 @@ a1int &a1int::set(long l)
QString a1int::toQString(int dec) const
{
QString r;
- if (in->length == 0) {
+ if (xca_asn1_string_length(in.get()) == 0) {
return r;
}
QSharedPointer<BIGNUM> bn(ASN1_INTEGER_to_BN(get0(), NULL), BN_free);
diff -Naurp xca-2.9.0.orig/lib/asn1time.cpp xca-2.9.0.new/lib/asn1time.cpp
--- xca-2.9.0.orig/lib/asn1time.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/asn1time.cpp 2026-07-21 15:48:01.479132516 +0200
@@ -11,6 +11,7 @@
#include "func.h"
#include "exception.h"
#include "asn1time.h"
+#include "openssl_compat.h"
#include <openssl/x509.h>
#include <openssl/err.h>
#include <openssl/opensslv.h>
@@ -50,7 +51,8 @@ int a1time::from_asn1(const ASN1_TIME *a
gt = ASN1_TIME_to_generalizedtime((ASN1_TIME*)a, NULL);
if (!gt)
return -1;
- t = QString::fromLatin1((char*)gt->data, gt->length);
+ t = QString::fromLatin1((char*)xca_asn1_string_get0_data(gt),
+ xca_asn1_string_length(gt));
ASN1_GENERALIZEDTIME_free(gt);
return fromPlain(t);
}
@@ -68,11 +70,15 @@ int a1time::fromPlain(const QString &pla
int a1time::set_asn1(const QString &str, int type) const
{
- if (!atime)
- atime = ASN1_TIME_new();
- if (!atime)
- return -1;
- atime->type = type;
+ if (atime && xca_asn1_string_type(atime) != type) {
+ ASN1_STRING_free(atime);
+ atime = NULL;
+ }
+ if (!atime) {
+ atime = ASN1_STRING_type_new(type);
+ if (!atime)
+ return -1;
+ }
if (ASN1_STRING_set(atime, str.toLatin1(), str.length()))
return -1;
return 0;
diff -Naurp xca-2.9.0.orig/lib/openssl_compat.h xca-2.9.0.new/lib/openssl_compat.h
--- xca-2.9.0.orig/lib/openssl_compat.h 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/openssl_compat.h 2026-07-21 16:05:30.252809689 +0200
@@ -35,4 +35,15 @@ EVP_DigestVerify(EVP_MD_CTX *ctx, const
}
#endif
+
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
+#define xca_asn1_string_length(p) ((p)->length)
+#define xca_asn1_string_get0_data(p) ((p)->data)
+#define xca_asn1_string_type(p) ((p)->type)
+#else
+#define xca_asn1_string_length(p) ASN1_STRING_length(p)
+#define xca_asn1_string_get0_data(p) ASN1_STRING_get0_data(p)
+#define xca_asn1_string_type(p) ASN1_STRING_type(p)
+#endif
+
#endif
diff -Naurp xca-2.9.0.orig/lib/pkcs11.cpp xca-2.9.0.new/lib/pkcs11.cpp
--- xca-2.9.0.orig/lib/pkcs11.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/pkcs11.cpp 2026-07-22 17:10:39.158463523 +0200
@@ -650,29 +650,6 @@ int pkcs11::encrypt(int flen, const unsi
return size;
}
-#if not defined OPENSSL_NO_EC and defined EVP_PKEY_ED25519
-// Shared between libressl and openssl
-static int eng_idx = -1;
-static int eng_finish(ENGINE *e)
-{
- pkcs11 *p11 = (pkcs11 *)ENGINE_get_ex_data(e, eng_idx);
- delete p11;
- ENGINE_set_ex_data(e, eng_idx, NULL);
- return 1;
-}
-
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
-static int eng_pmeth_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
-#else
-static int eng_pmeth_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
-#endif
-{
- void *p = EVP_PKEY_CTX_get_app_data((EVP_PKEY_CTX *)src);
- EVP_PKEY_CTX_set_app_data(dst, p);
- return 1;
-}
-#endif
-
static int rsa_privdata_free(RSA *rsa)
{
pkcs11 *priv = (pkcs11*)RSA_get_app_data(rsa);
@@ -830,10 +807,33 @@ static EC_KEY_METHOD *setup_ec_key_meth(
ec_set_private_proc, ec_set_public_proc);
return ec_key_meth;
}
-#ifdef EVP_PKEY_ED25519
+
+
+#if defined(EVP_PKEY_ED25519) && OPENSSL_VERSION_NUMBER < 0x40000000L
static EVP_PKEY_METHOD *p11_eddsa_method;
+// Shared between libressl and openssl
+static int eng_idx = -1;
+static int eng_finish(ENGINE *e)
+{
+ pkcs11 *p11 = (pkcs11 *)ENGINE_get_ex_data(e, eng_idx);
+ delete p11;
+ ENGINE_set_ex_data(e, eng_idx, NULL);
+ return 1;
+}
+
+#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+static int eng_pmeth_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
+#else
+static int eng_pmeth_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
+#endif
+{
+ void *p = EVP_PKEY_CTX_get_app_data((EVP_PKEY_CTX *)src);
+ EVP_PKEY_CTX_set_app_data(dst, p);
+ return 1;
+}
+
static int eddsa_eng_meths(ENGINE *e, EVP_PKEY_METHOD **m, const int **nids, int nid)
{
static const int my_nids[] = {EVP_PKEY_ED25519 };
@@ -904,7 +904,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY
#ifndef OPENSSL_NO_EC
static EC_KEY_METHOD *ec_key_meth = NULL;
EC_KEY *ec;
-#ifdef EVP_PKEY_ED25519
+#if defined(EVP_PKEY_ED25519) && OPENSSL_VERSION_NUMBER < 0x40000000L
static ENGINE *e = NULL;
if (!e) {
@@ -991,6 +991,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY
#ifdef EVP_PKEY_ED25519
case EVP_PKEY_ED25519:
size_t len;
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
if (ENGINE_get_ex_data(e, eng_idx))
qWarning() << "We forgot to free the previous Card key.";
ENGINE_set_ex_data(e, eng_idx, this);
@@ -1003,6 +1004,17 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY
openssl_error();
OPENSSL_free(pubkey);
//EVP_PKEY_set1_engine(evp, e);
+#else
+ p11obj = obj;
+ EVP_PKEY_get_raw_public_key(pub, NULL, &len);
+ unsigned char *pubkey = (unsigned char *)OPENSSL_malloc(len);
+ Q_CHECK_PTR(pubkey);
+ EVP_PKEY_get_raw_public_key(pub, pubkey, &len);
+ evp = EVP_PKEY_new_raw_public_key_ex(OSSL_LIB_CTX_get0_global_default(),
+ "ED25519", NULL, pubkey, len);
+ openssl_error();
+ OPENSSL_free(pubkey);
+#endif
break;
#endif
#endif
diff -Naurp xca-2.9.0.orig/lib/pki_pkcs12.cpp xca-2.9.0.new/lib/pki_pkcs12.cpp
--- xca-2.9.0.orig/lib/pki_pkcs12.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/pki_pkcs12.cpp 2026-07-21 14:41:11.421805953 +0200
@@ -85,7 +85,7 @@ pki_pkcs12::pki_pkcs12(const QString &fn
}
pki_ign_openssl_error();
if (mycert) {
- unsigned char *str = X509_alias_get0(mycert, NULL);
+ const unsigned char *str = X509_alias_get0(mycert, NULL);
if (str)
alias = QString::fromUtf8((const char *)str);
alias = QString::fromUtf8(alias.toLatin1());
diff -Naurp xca-2.9.0.orig/lib/pki_scard.cpp xca-2.9.0.new/lib/pki_scard.cpp
--- xca-2.9.0.orig/lib/pki_scard.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/pki_scard.cpp 2026-07-21 16:07:19.266072856 +0200
@@ -14,6 +14,7 @@
#include "pkcs11.h"
#include "x509name.h"
#include "func.h"
+#include "openssl_compat.h"
#include "XcaProgress.h"
#include "XcaWarningCore.h"
@@ -187,7 +188,8 @@ EVP_PKEY *pki_scard::load_pubkey(pkcs11
d2i_bytearray(D2I_VOID(d2i_ASN1_OCTET_STRING), ba);
pki_openssl_error();
- BIGNUM *bn = BN_bin2bn(os->data, os->length, NULL);
+ BIGNUM *bn = BN_bin2bn(xca_asn1_string_get0_data(os),
+ xca_asn1_string_length(os), NULL);
pki_openssl_error();
EC_POINT *point = EC_POINT_bn2point(group, bn, NULL, NULL);
@@ -215,8 +217,8 @@ EVP_PKEY *pki_scard::load_pubkey(pkcs11
d2i_bytearray(D2I_VOID(d2i_ASN1_OCTET_STRING), ba);
pki_openssl_error();
pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, NULL,
- (const uint8_t *)os->data,
- os->length);
+ (const uint8_t *)xca_asn1_string_get0_data(os),
+ xca_asn1_string_length(os));
pki_openssl_error();
ASN1_OCTET_STRING_free(os);
pki_openssl_error();
diff -Naurp xca-2.9.0.orig/lib/pki_x509.cpp xca-2.9.0.new/lib/pki_x509.cpp
--- xca-2.9.0.orig/lib/pki_x509.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/pki_x509.cpp 2026-07-21 16:09:29.644513174 +0200
@@ -836,7 +836,7 @@ pki_key *pki_x509::getPubKey() const
bool pki_x509::compareNameAndKey(pki_x509 *other)
{
int r;
- X509_NAME *s1, *s2;
+ const X509_NAME *s1, *s2;
EVP_PKEY *pub1, *pub2;
if (!cert || !other->cert)
diff -Naurp xca-2.9.0.orig/lib/pki_x509req.cpp xca-2.9.0.new/lib/pki_x509req.cpp
--- xca-2.9.0.orig/lib/pki_x509req.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/pki_x509req.cpp 2026-07-21 16:11:59.068866756 +0200
@@ -15,6 +15,7 @@
#include "db_base.h"
#include "x509name.h"
#include "exception.h"
+#include "openssl_compat.h"
#include <openssl/bio.h>
pki_x509req::pki_x509req(const QString &name)
@@ -204,7 +205,9 @@ void pki_x509req::addAttribute(int nid,
return;
ASN1_STRING *a = QStringToAsn1(content, nid);
- X509_REQ_add1_attr_by_NID(request, nid, a->type, a->data, a->length);
+ X509_REQ_add1_attr_by_NID(request, nid, xca_asn1_string_type(a),
+ xca_asn1_string_get0_data(a),
+ xca_asn1_string_length(a));
ASN1_STRING_free(a);
openssl_error_msg(QString("'%1' (%2)").arg(content).arg(OBJ_nid2ln(nid)));
}
diff -Naurp xca-2.9.0.orig/lib/x509name.cpp xca-2.9.0.new/lib/x509name.cpp
--- xca-2.9.0.orig/lib/x509name.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/x509name.cpp 2026-07-21 15:56:14.876877763 +0200
@@ -9,6 +9,7 @@
#include "base.h"
#include "func_base.h"
#include "BioByteArray.h"
+#include "openssl_compat.h"
#include <openssl/asn1.h>
#include <openssl/err.h>
#include "exception.h"
@@ -89,7 +90,7 @@ QString x509name::getMostPopular() const
QString x509name::getEntry(int i) const
{
QString ret;
- ASN1_STRING *d;
+ const ASN1_STRING *d;
if ( i<0 || i>entryCount() )
return ret;
@@ -102,7 +103,7 @@ QString x509name::getEntry(int i) const
QString x509name::getEntryTag(int i) const
{
QString s = QObject::tr("Invalid");
- ASN1_STRING *d;
+ const ASN1_STRING *d;
if (i<0 || i>=entryCount())
i = entryCount() - 1;
@@ -111,7 +112,7 @@ QString x509name::getEntryTag(int i) con
if (!d)
return s;
- s = ASN1_tag2str(d->type);
+ s = ASN1_tag2str(xca_asn1_string_type(d));
return s;
}
@@ -154,13 +155,13 @@ QStringList x509name::entryList(int i) c
int x509name::nid(int i) const
{
- X509_NAME_ENTRY *ne = X509_NAME_get_entry(get0(), i);
+ const X509_NAME_ENTRY *ne = X509_NAME_get_entry(get0(), i);
return ne ? OBJ_obj2nid(X509_NAME_ENTRY_get_object(ne)) : NID_undef;
}
QString x509name::getOid(int i) const
{
- X509_NAME_ENTRY *ne = X509_NAME_get_entry(_get(), i);
+ const X509_NAME_ENTRY *ne = X509_NAME_get_entry(_get(), i);
return ne ? OBJ_obj2QString(X509_NAME_ENTRY_get_object(ne), 1) : QString();
}
@@ -258,7 +259,10 @@ void x509name::addEntryByNid(int nid, co
if (entry.isEmpty())
return;
ASN1_STRING *a = QStringToAsn1(entry.simplified(), nid);
- X509_NAME_add_entry_by_NID(_get(), nid, a->type, a->data, a->length, -1, 0);
+ X509_NAME_add_entry_by_NID(_get(), nid,
+ xca_asn1_string_type(a),
+ xca_asn1_string_get0_data(a),
+ xca_asn1_string_length(a), -1, 0);
ASN1_STRING_free(a);
openssl_error_msg(QString("'%1' (%2)").arg(entry).arg(OBJ_nid2ln(nid)));
}
diff -Naurp xca-2.9.0.orig/lib/x509v3ext.cpp xca-2.9.0.new/lib/x509v3ext.cpp
--- xca-2.9.0.orig/lib/x509v3ext.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/x509v3ext.cpp 2026-07-22 17:43:52.060374543 +0200
@@ -10,6 +10,7 @@
#include "asn1int.h"
#include "func.h"
#include "exception.h"
+#include "openssl_compat.h"
#include <openssl/x509v3.h>
#include <openssl/stack.h>
#include <QStringList>
@@ -49,8 +50,8 @@ x509v3ext::~x509v3ext()
x509v3ext &x509v3ext::set(const X509_EXTENSION *n)
{
if (n) {
- ASN1_OCTET_STRING *str = X509_EXTENSION_get_data((X509_EXTENSION *)n);
- if (!str || !str->length)
+ const ASN1_OCTET_STRING *str = X509_EXTENSION_get_data((X509_EXTENSION *)n);
+ if (!str || !xca_asn1_string_length(str))
n = nullptr;
}
if (ext != nullptr)
@@ -116,7 +117,7 @@ x509v3ext &x509v3ext::create_ia5(int nid
const ASN1_OBJECT *x509v3ext::object() const
{
- ASN1_OBJECT *obj = nullptr;
+ const ASN1_OBJECT *obj = nullptr;
if (ext) {
obj = X509_EXTENSION_get_object(ext);
ign_openssl_error();
@@ -166,9 +167,9 @@ int x509v3ext::getCritical() const
return ext ? X509_EXTENSION_get_critical(ext) : 0;
}
-ASN1_OCTET_STRING *x509v3ext::getData() const
+const ASN1_OCTET_STRING *x509v3ext::getData() const
{
- return ext ? X509_EXTENSION_get_data(ext) : nullptr;;
+ return ext ? X509_EXTENSION_get_data(ext) : nullptr;
}
QString x509v3ext::getValue() const
@@ -318,7 +319,7 @@ static QString ipv6_from_binary(const un
static bool
genName2conf(GENERAL_NAME *gen, QString tag, QString *single, QString *sect)
{
- unsigned char *p;
+ const unsigned char *p;
QString ret;
switch (gen->type) {
@@ -335,22 +336,23 @@ genName2conf(GENERAL_NAME *gen, QString
return true;
}
case GEN_IPADD:
- p = gen->d.ip->data;
- if (gen->d.ip->length == 4) {
+ p = xca_asn1_string_get0_data(gen->d.ip);
+ if (xca_asn1_string_length(gen->d.ip) == 4) {
*single = QString("IP:%1.%2.%3.%4").
arg(p[0]).arg(p[1]).arg(p[2]).arg(p[3]);
return true;
- } else if(gen->d.ip->length == 8) {
+ } else if(xca_asn1_string_length(gen->d.ip) == 8) {
*single = QString("IP:%1.%2.%3.%4/%5.%6.%7.%8").
arg(p[0]).arg(p[1]).arg(p[2]).arg(p[3]).
arg(p[4]).arg(p[5]).arg(p[6]).arg(p[7]);
return true;
- } else if(gen->d.ip->length == 16) {
- *single = "IP:" + ipv6_from_binary(gen->d.ip->data);
+ } else if(xca_asn1_string_length(gen->d.ip) == 16) {
+ *single = "IP:" + ipv6_from_binary(xca_asn1_string_get0_data(gen->d.ip));
return true;
- } else if(gen->d.ip->length == 32) {
- *single = "IP:" + ipv6_from_binary(gen->d.ip->data) +
- "/" + ipv6_from_binary(gen->d.ip->data +16);
+ } else if(xca_asn1_string_length(gen->d.ip) == 32) {
+ *single = "IP:" +
+ ipv6_from_binary(xca_asn1_string_get0_data(gen->d.ip)) +
+ "/" + ipv6_from_binary(xca_asn1_string_get0_data(gen->d.ip) + 16);
return true;
}
return false;
@@ -372,9 +374,9 @@ genName2conf(GENERAL_NAME *gen, QString
*single = QString("otherName:%1;FORMAT:HEX,%2").
arg(obj2SnOid(gen->d.otherName->type_id)).
arg(asn1Type2Name(type));
- for (int i=0; i<a->length; i++) {
+ for (int i=0; i<xca_asn1_string_length(a); i++) {
*single += QString(":%1").
- arg((int)(a->data[i]), 2, 16, QChar('0'));
+ arg((int)(xca_asn1_string_get0_data(a)[i]), 2, 16, QChar('0'));
}
}
return true;
@@ -423,12 +425,12 @@ bool x509v3ext::parse_ia5(QString *singl
return false;
if (!str) {
- const unsigned char *p = getData()->data;
- str = d2i_ASN1_OCTET_STRING(NULL, &p, getData()->length);
+ const unsigned char *p = xca_asn1_string_get0_data(getData());
+ str = d2i_ASN1_OCTET_STRING(NULL, &p, xca_asn1_string_length(getData()));
if (ign_openssl_error() || !str)
return false;
ret = QString("<ERROR: NOT IA5 but %1>%2").
- arg(asn1Type2Name(str->type)).
+ arg(asn1Type2Name(xca_asn1_string_type(str))).
arg(QString(asn1ToQString(str)));
} else {
ret = QString(asn1ToQString(str));
@@ -824,10 +826,10 @@ bool x509v3ext::parse_generic(QString *,
const ASN1_OBJECT *o = object();
QString der, obj = o ? obj2SnOid(o) : QString("INVALID");
- ASN1_OCTET_STRING *v = getData();
+ const ASN1_OCTET_STRING *v = getData();
- for (int i=0; v && i < v->length; i++)
- der += QString(":%1").arg((int)(v->data[i]), 2, 16, QChar('0'));
+ for (int i=0; v && i < xca_asn1_string_length(v); i++)
+ der += QString(":%1").arg((int)(xca_asn1_string_get0_data(v)[i]), 2, 16, QChar('0'));
if (adv)
*adv = QString("%1=%2DER%3\n").arg(obj).
@@ -1037,7 +1039,7 @@ X509_EXTENSION *x509v3ext::get() const
bool x509v3ext::isValid() const
{
- return ext && getData() && getData()->length > 0 &&
+ return ext && getData() && xca_asn1_string_length(getData()) > 0 &&
OBJ_obj2nid(X509_EXTENSION_get_object(ext)) != NID_undef;
}
diff -Naurp xca-2.9.0.orig/lib/x509v3ext.h xca-2.9.0.new/lib/x509v3ext.h
--- xca-2.9.0.orig/lib/x509v3ext.h 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/lib/x509v3ext.h 2026-07-22 17:33:42.586049536 +0200
@@ -35,7 +35,7 @@ class x509v3ext
// bool operator == (const x509v3ext &x) const;
QString getObject() const;
int getCritical() const;
- ASN1_OCTET_STRING *getData() const;
+ const ASN1_OCTET_STRING *getData() const;
QString getValue() const;
QString getHtmlValue() const;
QString getConsoleValue(const QString &indent) const;
diff -Naurp xca-2.9.0.orig/widgets/CertDetail.cpp xca-2.9.0.new/widgets/CertDetail.cpp
--- xca-2.9.0.orig/widgets/CertDetail.cpp 2025-03-28 19:28:15.000000000 +0100
+++ xca-2.9.0.new/widgets/CertDetail.cpp 2026-07-22 17:48:13.703356907 +0200
@@ -16,6 +16,7 @@
#include "lib/func_base.h"
#include "lib/func.h"
#include "lib/XcaWarningCore.h"
+#include "lib/openssl_compat.h"
#include <QLabel>
#include <QPushButton>
#include <QLineEdit>
@@ -269,7 +270,7 @@ void CertDetail::setReq(pki_x509req *req
int count = X509_ATTRIBUTE_count(att);
for (int j=0; j<count; j++) {
- ASN1_TYPE *at = X509_ATTRIBUTE_get0_type(att, j);
+ const ASN1_TYPE *at = X509_ATTRIBUTE_get0_type(att, j);
label = labelFromAsn1String(at->value.asn1_string);
attrLayout->addWidget(label, ii, j +1);
}
@@ -289,7 +290,7 @@ QLabel *CertDetail::labelFromAsn1String(
QLabel *label;
label = new CopyLabel(this);
label->setText(asn1ToQString(s));
- label->setToolTip(QString(ASN1_tag2str(s->type)));
+ label->setToolTip(QString(ASN1_tag2str(xca_asn1_string_type(s))));
return label;
}

235
xca.spec
View file

@ -3,39 +3,26 @@
Summary: Graphical X.509 certificate management tool
Name: xca
Version: 2.9.0
Release: 5%{?dist}
# Automatically converted from old format: BSD - review is highly recommended.
License: LicenseRef-Callaway-BSD
Version: 2.2.1
Release: 1%{?dist}
License: BSD
URL: https://hohnstaedt.de/xca/
Source0: https://github.com/%{gitowner0}/%{gitproject0}/releases/download/RELEASE.%{version}/%{name}-%{version}.tar.gz
Source1: xca-2.5.0-README.IMPORTANT
Patch1: xca-2.9.0-openssl4.patch
BuildRequires: cmake
BuildRequires: gcc-c++
BuildRequires: cmake(Qt6Core)
BuildRequires: cmake(Qt6Widgets)
BuildRequires: cmake(Qt6Sql)
BuildRequires: cmake(Qt6Help)
BuildRequires: cmake(Qt6LinguistTools)
BuildRequires: cmake(Qt6Test)
BuildRequires: qt5-devel
BuildRequires: openssl-devel
%if 0%{?fedora} >= 41 && 0%{?fedora} <= 44
BuildRequires: openssl-devel-engine
%endif
BuildRequires: desktop-file-utils
BuildRequires: libappstream-glib
BuildRequires: xdg-utils
BuildRequires: ImageMagick
BuildRequires: linuxdoc-tools
BuildRequires: libtool-ltdl-devel
BuildRequires: python3-sphinx
BuildRequires: python3-sphinxcontrib-qthelp
BuildRequires: translate-toolkit
Requires: hicolor-icon-theme
Suggests: qt6-qtbase-mysql
Suggests: qt6-qtbase-postgresql
Suggests: qt6-qtbase-odbc
Suggests: qt5-qtbase-mysql
Suggests: qt5-qtbase-postgresql
Suggests: qt5-qtbase-odbc
%description
@ -46,10 +33,10 @@ OpenSSL library for the cryptographic operations.
Certificate signing requests (PKCS#10), certificates (X509v3), the signing
of requests, the creation of self-signed certificates, certificate revocation
lists and SmartCards are supported. For an easy company-wide use, customizable
templates can be used for certificate and request generation. The PKI
structures can be imported and exported in several formats like PKCS#7,
PKCS#12, PEM, DER, PKCS#8. All cryptographic data are stored in a byte order
agnostic file format, portable across operating systems.
templates can be used for certificate and request generation. The PKI structures
can be imported and exported in several formats like PKCS#7, PKCS#12, PEM,
DER, PKCS#8. All cryptographic data are stored in a byte order agnostic file
format, portable across operating systems.
#-------------------------------------------------------------------------------
@ -57,74 +44,84 @@ agnostic file format, portable across operating systems.
#-------------------------------------------------------------------------------
%autosetup -p 1
cp '%{SOURCE1}' README.IMPORTANT
#-------------------------------------------------------------------------------
%build
#-------------------------------------------------------------------------------
export CXXFLAGS='%{optflags} -DDOCDIR=\"%{_docdir}/xca\"'
%cmake -DCMAKE_SHARED_LINKER_FLAGS="-Wl,--as-needed"
%cmake_build
%configure CXXFLAGS="${RPM_OPT_FLAGS}" \
STRIP=: \
LIBS="-Wl,-as-needed"
make %{?_smp_mflags}
convert img/xca.ico xca.png
touch -r img/xca.ico xca.png
convert img/xdb.ico xdb.png
touch -r img/xdb.ico xdb.png
#-------------------------------------------------------------------------------
%install
#-------------------------------------------------------------------------------
%cmake_install
make destdir="${RPM_BUILD_ROOT}" install
# Do not include db statistics program and man.
find '%{buildroot}' -name 'xca_db_stat*' -delete
# Do not include db statistics program and man.
find "${RPM_BUILD_ROOT}" -name 'xca_db_stat*' -delete
# Do not use pixmaps directory.
rm -rf '%{buildroot}%{_datadir}/pixmaps'
install -d -m 755 "${RPM_BUILD_ROOT}%{_datadir}/mime/packages"
install -p -m 644 misc/xca.xml "${RPM_BUILD_ROOT}%{_datadir}/mime/packages/"
# Reinstall documentation.
rm -rf '%{buildroot}%{_docdir}/xca'/*
mv '%{buildroot}%{_datadir}/xca/html' '%{buildroot}%{_docdir}/xca/'
export XDG_DATA_DIRS="${RPM_BUILD_ROOT}%{_datadir}"
export XDG_UTILS_INSTALL_MODE=system
# Install mime file types.
install -d -m 755 '%{buildroot}%{_datadir}/mime/packages'
install -p -m 644 misc/xca.xml '%{buildroot}%{_datadir}/mime/packages/'
install -d -m 755 "${XDG_DATA_DIRS}/icons/hicolor"
xdg-icon-resource install --noupdate --context mimetypes \
--size 32 xdb.png application-x-xca-database
xdg-icon-resource install --noupdate --size 32 xca.png fedora-xca
# Validate desktop files.
desktop-file-validate \
'%{buildroot}%{_datadir}/applications/de.hohnstaedt.xca.desktop'
appstream-util validate-relax --nonet \
'%{buildroot}%{_metainfodir}/de.hohnstaedt.xca.metainfo.xml'
# Replace the desktop icon.
rm -rf "${RPM_BUILD_ROOT}%{_datadir}/pixmaps/xca-32x32.xpm"
cp -a img/key.xpm "${RPM_BUILD_ROOT}%{_datadir}/pixmaps/xca.xpm"
# Template contains neither translations nor language code.
rm -f '%{buildroot}%{_datadir}/xca/i18n/xca.qm'
install -d -m 755 "${RPM_BUILD_ROOT}%{_datadir}/applications"
desktop-file-install --mode 0644 \
--dir "${RPM_BUILD_ROOT}%{_datadir}/applications" \
--delete-original \
--add-mime-type application/x-xca-database \
--remove-category QT \
--set-icon=xca \
"${RPM_BUILD_ROOT}%{_datadir}/applications/xca.desktop"
# Will build the doc directory ourself.
rm -rf "${RPM_BUILD_ROOT}%{_docdir}/xca"
# Tag translation files.
%find_lang '%{name}' --with-qt
(
cd "${RPM_BUILD_ROOT}"
find '.%{_datadir}/xca' -name 'xca_[a-z][a-z]*.qm'
) |
sed -e 's/^\.//' \
-e 's#^.*/xca_\([a-z][a-z]\)[^/]*\.qm$#%lang(\1) &#' > langfiles
#-------------------------------------------------------------------------------
%check
%files -f langfiles
#-------------------------------------------------------------------------------
# Do not test GUI.
%ctest -E '^testxca$' || :
#-------------------------------------------------------------------------------
%files -f %{name}.lang
#-------------------------------------------------------------------------------
%doc AUTHORS COPYRIGHT README.IMPORTANT
%doc %{_docdir}/xca/*
%{_bindir}/xca
%doc AUTHORS COPYRIGHT
%doc doc/*.html
%{_bindir}/*
%dir %{_datadir}/xca
%{_datadir}/xca/*.txt
%{_datadir}/xca/*.xca
%{_datadir}/pixmaps/*.xpm
%{_datadir}/icons/*/*/*/*.png
%{_datadir}/mime/packages/%{name}.*
%{_datadir}/applications/de.hohnstaedt.xca.desktop
%{_datadir}/bash-completion/
%{_metainfodir}/de.hohnstaedt.xca.metainfo.xml
%{_datadir}/applications/*
%attr(0644, root, root) %{_mandir}/*/*
@ -132,115 +129,9 @@ rm -f '%{buildroot}%{_datadir}/xca/i18n/xca.qm'
%changelog
#-------------------------------------------------------------------------------
* Wed Jul 22 2026 Patrick Monnerat <patrick@monnerat.net> 2.9.0-5
- Patch "openssl4" for openssl version 4 compatibility.
- Remove BR openssl-devel-engine for Fedora > 44.
- Perform tests.
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.9.0-3
- Rebuilt for openssl 4.0
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Mon Sep 01 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 2.9.0-1
- Update to 2.9.0
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Fri Sep 6 2024 Patrick Monnerat <patrick@monnerat.net> 2.7.0-1
- New upstream release.
* Wed Sep 4 2024 Miroslav Suchý <msuchy@redhat.com> - 2.6.0-5
- convert license to SPDX
* Tue Jul 23 2024 Patrick Monnerat <patrick@monnerat.net> 2.6.0-4
- BR openssl-devel-engine for Fedora >= 41.
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Mon May 6 2024 Patrick Monnerat <patrick@monnerat.net> 2.6.0-2
- Fix application icon.
https://bugzilla.redhat.com/show_bug.cgi?id=2279161
* Sun Mar 17 2024 Patrick Monnerat <patrick@monnerat.net> 2.6.0-1
- New upstream release.
* Mon Jan 22 2024 Patrick Monnerat <patrick@monnerat.net> 2.5.0-3
- Patch "pastekey" fixes a crash pasting an encrypted private key.
https://github.com/chris2511/xca/commit/d29d55a
- Patch "revokedel" fixes a freeze when deleting a certificate.
https://github.com/chris2511/xca/commit/43e1b33
- Patch "delete_after_revoke" fixes a crash deleting+revoking a certificate.
https://bugzilla.redhat.com/show_bug.cgi?id=2259477
* Tue Nov 07 2023 Miro Hrončok <mhroncok@redhat.com> - 2.5.0-2
- Explicitly BuildRequire python3-sphinxcontrib-qthelp
* Fri Oct 6 2023 Patrick Monnerat <patrick@monnerat.net> 2.5.0-1
- New upstream release.
- Build using cmake.
- Doc file "README.IMPORTANT" for needed passord reset.
https://github.com/chris2511/xca/issues/458#issuecomment-1740106691
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Sat Nov 13 2021 Patrick Monnerat <patrick@monnerat.net> 2.4.0-1
- New upstream release.
- Patch "openssl3" for openssl version 3 compatibility.
- Patch "noclean" fixes building in symlinked directory.
- Patch "mimeicons" to declare mime types icons as generic.
- Patch "lang-it" to update italian translation.
- Patch "lang-fr" to update french translation.
- Uses sphinx instead of SGML for documentation.
- Use new icons.
* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.3.0-5
- Rebuilt with OpenSSL 3.0.0
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Dec 1 2020 Patrick Monnerat <patrick@monnerat.net> 2.3.0-2
- BR translate-toolkit is not needed anymore.
* Thu Aug 6 2020 Patrick Monnerat <patrick@monnerat.net> 2.3.0-1
- New upstream relase.
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.1-3
- Second attempt - Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Sat Feb 8 2020 Patrick Monnerat <patrick@monnerat.net> 2.2.1-1
- New upstream relase.
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.2-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Dec 9 2019 Patrick Monnerat <patrick@monnerat.net> 2.1.2-4
- Patch "bz1779029-segv" fixes a segmentation fault.
https://github.com/chris2511/xca/commit/262c805