agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)
Date: Mon, 10 Aug 2026 00:14:26 +0000
Message-ID: <E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org> (raw)
Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)
cryptohash_openssl.c initialized the EVP_MD_CTX with the implicit static
digest objects (EVP_sha256() and friends). These do not dispatch
through a loaded provider. OpenSSL 3.0 and newer versions recommend to
switch to an explicit fetch, using EVP_MD_fetch(), the older routines
being deprecated, available for backward-compatibility purposes.
Now, when building with OpenSSL 3.0 or a newer bersion, we fetch the
digest by name with EVP_MD_fetch(), cache it in the context, and free it
on teardown. This has as consequence to feed the hash from a provider.
The implicit path is kept for older OpenSSL, 1.1.1 being the oldest
version still supported on HEAD, and for LibreSSL.
This is a slight change in the hashing logic. No backpatch is done as
that looks safer, and the code in the back-branches is also able to
work. This has been locally tested across OpenSSL 1.1.1 up to 3.5, so
hopefully nothing is broken.
Note: The submitted code was clearly AI-generated. I have spend a bit
of time cleaning it up, making it more consistent with the project style
in terms of coding, adjusting a few more things on the way.
Author: Mark Atwood <mark@reviewcommit.com>
Co-authored-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/178596055358.1584287.8485463954311014881@reviewcommit.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/b91f79cd08abba7a800d3faf79bb96e8adc8752e
Modified Files
--------------
src/common/cryptohash_openssl.c | 47 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)
Message-ID: <E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org>
Permalink: ../E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)
In-Reply-To: <E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox