mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xmlsecurity: fix tests to run with system NSS on Fedora 40

Browse Source 
testDropMacroTemplateSignature fails printing this:

  warn:xmlsecurity.xmlsec:3511616:3511616:xmlsecurity/source/xmlsec/errorcallback.cxx:53: signatures.c:599: xmlSecNssSignatureSetKey() 'rsa-sha1' 'VFY_CreateContext' 4 'NSS error: -8011'

because policy sets NSS_RSA_MIN_KEY_SIZE to 2048.

testPDFGood fails printing this:

  warn:svl.crypto:3587940:3587940:svl/source/crypto/cryptosign.cxx:1941: ValidateSignature: message is not signed
  warn:xmlsecurity.helper:3587940:3587940:xmlsecurity/source/helper/pdfsignaturehelper.cxx:482: failed to determine digest match

because enabling SEC_OID_SHA1 for NSS_USE_ALG_IN_ANY_SIGNATURE doesn't
enable it for SMIME signatures, so smime_allowed_by_policy() fails -
obviously one has to use NSS_USE_ALG_IN_SIGNATURE to enable it in any
signature.

Change-Id: I59ffaf0994eee6b51362fd3296f61465d0fc7903
(cherry picked from commit a7b7b00b78426bff8607c77106ea62dd213f0821)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178663
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
This commit is contained in:
Michael Stahl
2024-12-17 13:41:33 +01:00
parent b88a3f1f16
commit fae1eb775d
4 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
xmlsecurity/CppunitTest_xmlsecurity_pdfsigning.mk
View File

@@ -39,6 +39,7 @@ ifneq ($(OS),WNT)
ifneq (,$(ENABLE_NSS))
$(eval $(call gb_CppunitTest_use_externals,xmlsecurity_pdfsigning,\
nssutil3 \
nss3 \
))
endif
endif

1
xmlsecurity/CppunitTest_xmlsecurity_signing.mk
View File

@@ -44,6 +44,7 @@ ifneq ($(OS),WNT)
ifneq (,$(ENABLE_NSS))
$(eval $(call gb_CppunitTest_use_externals,xmlsecurity_signing,\
nssutil3 \
nss3 \
))
endif
endif

5
xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx
View File

@@ -13,6 +13,7 @@
#if USE_CRYPTO_NSS
#include <secoid.h>
#include <nss.h>
#endif
#include <string_view>
@@ -81,7 +82,9 @@ void PDFSigningTest::setUp()
#ifdef NSS_USE_ALG_IN_ANY_SIGNATURE
// policy may disallow using SHA1 for signatures but unit test documents
// have such existing signatures (call this after createSecurityContext!)
NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_ANY_SIGNATURE, 0);
NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_SIGNATURE, 0);
// the minimum is 2048 in Fedora 40
NSS_OptionSet(NSS_RSA_MIN_KEY_SIZE, 1024);
#endif
#endif
}

5
xmlsecurity/qa/unit/signing/signing.cxx
View File

@@ -15,6 +15,7 @@
#if USE_CRYPTO_NSS
#include <secoid.h>
#include <nss.h>
#endif
#include <test/unoapixml_test.hxx>
@@ -104,7 +105,9 @@ void SigningTest::setUp()
#ifdef NSS_USE_ALG_IN_ANY_SIGNATURE
// policy may disallow using SHA1 for signatures but unit test documents
// have such existing signatures (call this after createSecurityContext!)
NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_ANY_SIGNATURE, 0);
NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_SIGNATURE, 0);
// the minimum is 2048 in Fedora 40
NSS_OptionSet(NSS_RSA_MIN_KEY_SIZE, 1024);
#endif
#endif
}