postgres.git / summary / log / commit / refs

commit    cad781b3e5de615e8a570950e455bd04cdadeafd
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Fri May 09 16:29:01 2025 +0000
First released in: 18.0, 15.14, 16.10, 17.6

    Skip RSA-PSS ssl test when using LibreSSL.
    
    Presently, LibreSSL does not have working support for RSA-PSS,
    so disable that test.  Per discussion at
    https://marc.info/?l=libressl&m=174664225002441&w=2
    they do intend to fix this, but it's a ways off yet.
    
    Reported-by: Thomas Munro <thomas.munro@gmail.com>
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
    Discussion: https://postgr.es/m/CA+hUKG+fLqyweHqFSBcErueUVT0vDuSNWui-ySz3+d_APmq7dw@mail.gmail.com
    Backpatch-through: 15


 src/test/ssl/t/002_scram.pl | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index 28c54bdb09f..b84e12691ed 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -44,14 +44,21 @@ my $SERVERHOSTADDR = '127.0.0.1';
 # This is the pattern to use in pg_hba.conf to match incoming connections.
 my $SERVERHOSTCIDR = '127.0.0.1/32';
 
+# Determine whether this build uses OpenSSL or LibreSSL.
+my $libressl = $ssl_server->is_libressl;
+
 # Determine whether build supports tls-server-end-point.
 my $supports_tls_server_end_point =
   check_pg_config("#define HAVE_X509_GET_SIGNATURE_NID 1");
+
 # Determine whether build supports detection of hash algorithms for
 # RSA-PSS certificates.
 my $supports_rsapss_certs =
   check_pg_config("#define HAVE_X509_GET_SIGNATURE_INFO 1");
 
+# As of 5/2025, LibreSSL doesn't actually work for RSA-PSS certificates.
+$supports_rsapss_certs = 0 if $libressl;
+
 # Allocation of base connection string shared among multiple tests.
 my $common_connstr;
 


[parent: 27fbf7cb6391]