From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fKrVy4BJ1z2yBG for ; Tue, 24 Feb 2026 08:29:46 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fKrVx65Msz2xP7 for ; Tue, 24 Feb 2026 08:29:45 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E7" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4fKrVw5qZBz3WV for ; Tue, 24 Feb 2026 08:29:44 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1771921784; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=0V4v2Tgm6uLZ56iCC6iL3iHpxhcWYVklyTO93cucxrY=; b=rvrwYN85XCVSQOChYgScv0aJtT6u/s+KcIMFTQTpAN3fWiwjIgD5Job9O1YD6/ubYcSxyR 2JHcWi7/vBFQYfBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1771921784; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=0V4v2Tgm6uLZ56iCC6iL3iHpxhcWYVklyTO93cucxrY=; b=KJ07Lpwixle01qVhXXpsZnB6Xqpa9MIdxNc3rqUiNpUTQTCIFHQ9MW7Tldj7LdO/BPd+gk iS45H0I5DriKHAs7Rl4BMeWyZyDKwKoEE4MWUvz7vM7xl6rWgqtVacz62lWbOegSIlu88K J8Fhq2QC8+xKRMDftVclUPJ04cxkMkdLx3RS6sm2E+qQc7uO4/QCcQJ3b57BwwbgRHwWOc Is/eTZkfkD5ioSi6UipZX2Etx+ujxPU5WG8UBtLYVJc9WSahzWsapWc2+yqDQ7xubbVXHf y4YooJY/gc9tuJg66s1f7XoSM1ehjA3oj/U4xoq3MJBx/pQUzV7gZ+QY7IDL1g== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4fKrVw5LLTz2xrF; Tue, 24 Feb 2026 08:29:44 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. b51c323f7bbd3165fc5294d97c790a9e6f57917b X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: a393fad6fb2e0ed829d1b9dc1791e2db375031af X-Git-Newrev: b51c323f7bbd3165fc5294d97c790a9e6f57917b Message-Id: <4fKrVw5LLTz2xrF@people01.haj.ipfire.org> Date: Tue, 24 Feb 2026 08:29:44 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via b51c323f7bbd3165fc5294d97c790a9e6f57917b (commit) via 6b37324b0a6e2f99a44fdf71238632ebb0d32a82 (commit) from a393fad6fb2e0ed829d1b9dc1791e2db375031af (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b51c323f7bbd3165fc5294d97c790a9e6f57917b Merge: a393fad6f 6b37324b0 Author: Michael Tremer Date: Tue Feb 24 08:29:37 2026 +0000 Merge branch 'master' into next ----------------------------------------------------------------------- Summary of changes: lfs/dehydrated | 6 ++-- ...plement_workaround_for_openssl_regression.patch | 33 ++++++++++++++++++++++ ..._nout_flag_from_time-based_validity_check.patch | 23 +++++++++++++++ 3 files changed, 60 insertions(+), 2 deletions(-) create mode 100644 src/patches/dehydrated-0.7.2_implement_workaround_for_openssl_regression.patch create mode 100644 src/patches/dehydrated-0.7.2_remove_nout_flag_from_time-based_validity_check.patch Difference in files: diff --git a/lfs/dehydrated b/lfs/dehydrated index ab2bf8acd..0c4004e18 100644 --- a/lfs/dehydrated +++ b/lfs/dehydrated @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = dehydrated -PAK_VER = 7 +PAK_VER = 8 DEPS = @@ -81,6 +81,8 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dehydrated-0.7.2_implement_workaround_for_openssl_regression.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dehydrated-0.7.2_remove_nout_flag_from_time-based_validity_check.patch # Install the script cd $(DIR_APP) && install -m 755 dehydrated \ diff --git a/src/patches/dehydrated-0.7.2_implement_workaround_for_openssl_regression.patch b/src/patches/dehydrated-0.7.2_implement_workaround_for_openssl_regression.patch new file mode 100644 index 000000000..9fb6a56ee --- /dev/null +++ b/src/patches/dehydrated-0.7.2_implement_workaround_for_openssl_regression.patch @@ -0,0 +1,33 @@ +From 1dbbc64ce947af000b764e806429e3f87cb3a55e Mon Sep 17 00:00:00 2001 +From: Lukas Schauer +Date: Fri, 24 Oct 2025 09:14:05 +0200 +Subject: [PATCH] implement workaround for openssl regression (fixes #981) + +The introduction of the `-multi` option to the x509 subcommand +introduced a regression to the `-checkend` behaviour, preventing +openssl to correctly indicate the certificate expiry status via +its exit code. + +This commit introduces a (maybe temporary) workaround by instead +checking the output string. +--- + dehydrated | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/dehydrated b/dehydrated +index 28c4711..4867151 100755 +--- a/dehydrated ++++ b/dehydrated +@@ -1952,7 +1952,7 @@ command_sign_domains() { + valid="$("${OPENSSL}" x509 -enddate -noout -in "${cert}" | cut -d= -f2- )" + + printf " + Valid till %s " "${valid}" +- if ("${OPENSSL}" x509 -checkend $((RENEW_DAYS * 86400)) -noout -in "${cert}" > /dev/null 2>&1); then ++ if ("${OPENSSL}" x509 -checkend $((RENEW_DAYS * 86400)) -noout -in "${cert}" 2>&1 | grep -q "will not expire"); then + printf "(Longer than %d days). " "${RENEW_DAYS}" + if [[ "${force_renew}" = "yes" ]]; then + echo "Ignoring because renew was forced!" +-- +2.47.3 + + diff --git a/src/patches/dehydrated-0.7.2_remove_nout_flag_from_time-based_validity_check.patch b/src/patches/dehydrated-0.7.2_remove_nout_flag_from_time-based_validity_check.patch new file mode 100644 index 000000000..1a2876847 --- /dev/null +++ b/src/patches/dehydrated-0.7.2_remove_nout_flag_from_time-based_validity_check.patch @@ -0,0 +1,23 @@ +From 2e6933464e1d68352e9f58e36373ac9f092ecebb Mon Sep 17 00:00:00 2001 +From: Lukas Schauer +Date: Tue, 3 Feb 2026 22:01:15 +0100 +Subject: [PATCH] remove noout flag from time-based validity check + +--- + dehydrated | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/dehydrated b/dehydrated +index 48671513..beb54344 100755 +--- a/dehydrated ++++ b/dehydrated +@@ -1952,7 +1952,7 @@ command_sign_domains() { + valid="$("${OPENSSL}" x509 -enddate -noout -in "${cert}" | cut -d= -f2- )" + + printf " + Valid till %s " "${valid}" +- if ("${OPENSSL}" x509 -checkend $((RENEW_DAYS * 86400)) -noout -in "${cert}" 2>&1 | grep -q "will not expire"); then ++ if ("${OPENSSL}" x509 -checkend $((RENEW_DAYS * 86400)) -in "${cert}" 2>&1 | grep -q "will not expire"); then + printf "(Longer than %d days). " "${RENEW_DAYS}" + if [[ "${force_renew}" = "yes" ]]; then + echo "Ignoring because renew was forced!" + hooks/post-receive -- IPFire 2.x development tree