libtls for OpenSSL https://git.causal.agency/libretls/atom?h=3.2.0 2020-08-05T15:43:02+00:00 2020-08-05T15:43:02+00:00 C. McEnroe june@causal.agency 2020-08-05T15:43:02+00:00 urn:sha1:cc13f4d43a9e6f8544f347800adbbe5000b83305 2020-08-04T02:27:18+00:00 C. McEnroe june@causal.agency 2020-08-04T02:27:18+00:00 urn:sha1:1f76eb0e84b70024abe78149bef743a7b7699590 2020-08-03T22:46:12+00:00 C. McEnroe june@causal.agency 2020-08-03T22:46:12+00:00 urn:sha1:29ffdabc1d928f522b3d020366d459c952d96c11 2020-08-02T19:42:48+00:00 C. McEnroe june@causal.agency 2020-07-30T22:14:06+00:00 urn:sha1:826d0c4704653740f695d6b4dc8546f2ad3e688e 2020-08-02T19:42:48+00:00 C. McEnroe june@causal.agency 2020-07-30T22:21:51+00:00 urn:sha1:1a24fe87cb1a9b55ae59734cd5eb31a71d58888d Copied from crypto/Makefile.am for the ones that are actually used by libtls. 2020-08-02T19:42:48+00:00 C. McEnroe june@causal.agency 2020-07-30T22:08:59+00:00 urn:sha1:e5c08e2f0787eb1a1532ea3c0957892250007b07 2020-08-01T03:10:51+00:00 C. McEnroe june@causal.agency 2020-07-30T22:01:09+00:00 urn:sha1:4a1d363bc4484da48480aa518c684d13aff87012 2020-08-01T03:10:51+00:00 C. McEnroe june@causal.agency 2020-08-01T02:53:27+00:00 urn:sha1:a6df11f2bbd2c9cdf4a8f16d93d8a56c8f41c68d This removes the hard dependency on a CA bundle file existing in the default path (which seems to not be the case on Debian, for example), but results in a subtle behaviour change: if the CA bundle file does not exist, the CA directory will be used instead, rather than failing hard. I believe the only reason libtls insists on loading a CA bundle file itself is so that it can be sandboxed afterwards, given that a file is loaded all at once while a directory is only loaded as needed. If the default CA bundle file exists, SSL_CTX_set_default_verify_paths will still immediately load it, so sandboxing will still work. If it doesn't exist, then the CA directory will be used, which will work well for unsandboxed applications, but will likely fail during verification as it tries to search the directory. Either way, if the CA bundle file does not exist, a sandboxed application will not work. Enabling the use of the CA directory, however, will allow more unsandboxed applications to work. Finally, to restore the original behaviour, an application can call tls_config_set_ca_file(3) with the path returned by tls_default_ca_cert_file(3). 2020-08-01T03:10:24+00:00 C. McEnroe june@causal.agency 2020-08-01T00:58:06+00:00 urn:sha1:d5fc754c283290ea5279b9e6be3d4d2ee8355415 2020-07-31T16:12:53+00:00 C. McEnroe june@causal.agency 2020-07-28T22:07:50+00:00 urn:sha1:340298e90cd680a2cfde1966bb8ff0a7fea4b527