Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit d3a8639

Browse files
committed
Restore certificate check compatibility w/ RC2-40-CBC encrypted PKS#12
The "Check Certificates" GitHub Actions workflow uses OpenSSL to check for problems with the project's signing certificates. Certificates exported to PKS#12 archive files using older tools may have been encrypted using the "RC2-40-CBC" algorithm. Due to the availability of more secure modern alternatives, default support for RC2-40-CBC encryption was dropped in OpenSSL 3.x. The macOS signing certificate uses this RC2-40-CBC encryption. The "Check Certificates" GitHub Actions workflow runs on the `ubuntu-latest` runner. Previously, this runner used Ubuntu 20.04. This has now changed to Ubuntu 22.04. With the operating system update came an OpenSSL update from 1.1.1f to 3.0.2. This caused the workflow runs to fail on the macOS certificate job: Error outputting keys and certificates 80FBB0C5087F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties () Even though no longer done by default, OpenSSL still supports RC2-40-CBC encryption via its "legacy" provider. So compatibility with the certificate is restored by adding the `-legacy` flag to the `openssl pkcs12` commands.
1 parent c4172ee commit d3a8639

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

‎.github/workflows/check-certificates.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ jobs:
5959
(
6060
openssl pkcs12 \
6161
-in "${{ env.CERTIFICATE_PATH }}" \
62-
-noout -passin env:CERTIFICATE_PASSWORD
62+
-legacy \
63+
-noout \
64+
-passin env:CERTIFICATE_PASSWORD
6365
) || (
6466
echo "::error::Verification of ${{ matrix.certificate.identifier }} failed!!!"
6567
exit 1
@@ -87,6 +89,7 @@ jobs:
8789
openssl pkcs12 \
8890
-in "${{ env.CERTIFICATE_PATH }}" \
8991
-clcerts \
92+
-legacy \
9093
-nodes \
9194
-passin env:CERTIFICATE_PASSWORD
9295
) | (

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /