mirror of
https://github.com/trailofbits/algo.git
synced 2025-09-10 05:53:27 +02:00
be744b16a2
* chore: Conservative dependency updates for security - Update Ansible from 9.1.0 to 9.2.0 (one minor version bump only) - Update Jinja2 to ~3.1.6 to fix CVE-2025-27516 (critical security fix) - Pin netaddr to 1.3.0 (current stable version) This is a minimal, conservative update focused on: 1. Critical security fix for Jinja2 2. Minor ansible update for bug fixes 3. Pinning netaddr to prevent surprises No changes to Ansible collections - keeping them unpinned for now. * fix: Address linter issues (ruff, yamllint, shellcheck) - Fixed ruff configuration by moving linter settings to [tool.ruff.lint] section - Fixed ruff code issues: - Moved imports to top of files (E402) - Removed unused variables or commented them out - Updated string formatting from % to .format() - Replaced dict() calls with literals - Fixed assert False usage in tests - Fixed yamllint issues: - Added missing newlines at end of files - Removed trailing spaces - Added document start markers (---) to YAML files - Fixed 'on:' truthy warnings in GitHub workflows - Fixed shellcheck issues: - Properly quoted variables in shell scripts - Fixed A && B || C pattern with proper if/then/else - Improved FreeBSD rc script quoting All linters now pass without errors related to our code changes. * fix: Additional yamllint fixes for GitHub workflows - Added document start markers (---) to test-effectiveness.yml - Fixed 'on:' truthy warning by quoting as 'on:' - Removed trailing spaces from main.yml - Added missing newline at end of test-effectiveness.yml
99 lines
2.8 KiB
Python
99 lines
2.8 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Test OpenSSL compatibility - focused on version detection and legacy flag support
|
|
Based on issues #14755, #14718 - Apple device compatibility
|
|
"""
|
|
import os
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
|
|
|
|
def test_openssl_version_detection():
|
|
"""Test that we can detect OpenSSL version"""
|
|
result = subprocess.run(
|
|
['openssl', 'version'],
|
|
capture_output=True,
|
|
text=True
|
|
)
|
|
|
|
assert result.returncode == 0, "Failed to get OpenSSL version"
|
|
|
|
# Parse version - e.g., "OpenSSL 3.0.2 15 Mar 2022"
|
|
version_match = re.search(r'OpenSSL\s+(\d+)\.(\d+)\.(\d+)', result.stdout)
|
|
assert version_match, f"Can't parse OpenSSL version: {result.stdout}"
|
|
|
|
major = int(version_match.group(1))
|
|
minor = int(version_match.group(2))
|
|
|
|
print(f"✓ OpenSSL version detected: {major}.{minor}")
|
|
|
|
# Return version for other tests
|
|
return (major, minor)
|
|
|
|
|
|
def test_legacy_flag_support():
|
|
"""Test if OpenSSL supports -legacy flag (issue #14755)"""
|
|
major, minor = test_openssl_version_detection()
|
|
|
|
# Test genrsa with -legacy flag
|
|
with tempfile.NamedTemporaryFile(suffix='.key', delete=False) as f:
|
|
temp_key = f.name
|
|
|
|
try:
|
|
# Try with -legacy flag
|
|
result_legacy = subprocess.run(
|
|
['openssl', 'genrsa', '-legacy', '-out', temp_key, '2048'],
|
|
capture_output=True,
|
|
text=True
|
|
)
|
|
|
|
# Try without -legacy flag
|
|
result_normal = subprocess.run(
|
|
['openssl', 'genrsa', '-out', temp_key, '2048'],
|
|
capture_output=True,
|
|
text=True
|
|
)
|
|
|
|
# Check which one worked
|
|
legacy_supported = result_legacy.returncode == 0
|
|
normal_works = result_normal.returncode == 0
|
|
|
|
assert normal_works, "OpenSSL genrsa should work without -legacy"
|
|
|
|
if major >= 3:
|
|
# OpenSSL 3.x should support -legacy
|
|
print(f"✓ OpenSSL {major}.{minor} legacy flag support: {legacy_supported}")
|
|
else:
|
|
# OpenSSL 1.x doesn't have -legacy flag
|
|
assert not legacy_supported, f"OpenSSL {major}.{minor} shouldn't support -legacy"
|
|
print(f"✓ OpenSSL {major}.{minor} correctly doesn't support -legacy")
|
|
|
|
finally:
|
|
if os.path.exists(temp_key):
|
|
os.unlink(temp_key)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
tests = [
|
|
test_openssl_version_detection,
|
|
test_legacy_flag_support,
|
|
]
|
|
|
|
failed = 0
|
|
for test in tests:
|
|
try:
|
|
test()
|
|
except AssertionError as e:
|
|
print(f"✗ {test.__name__} failed: {e}")
|
|
failed += 1
|
|
except Exception as e:
|
|
print(f"✗ {test.__name__} error: {e}")
|
|
failed += 1
|
|
|
|
if failed > 0:
|
|
print(f"\n{failed} tests failed")
|
|
sys.exit(1)
|
|
else:
|
|
print(f"\nAll {len(tests)} tests passed!")
|