Add MODMARIADB_DEFAULTS_FILE to mariadb module
The default sets innodb_buffer_pool_size_max=512m because otherwise
none of the modules that try to use it for tests work as they want
to allocate enough memory to run an LLM.
While here, give mariadb a bit more time to start,
my machine is apparently slow.
OK Brad Smith <brad () comstyle ! com> (MAINTAINER)
relayd-regress: rewirte TLS tests with new keypair syntax
- TLS and non-TLS tests are handled differently now.
- Provide a CERTBASE environment for each TLS test which points to the
cert/key to test.
- The single ECDSA test has been removed, as all TLS tests are now run
separately using RSA and ECDSA certificates.
- Makefile tweaks: renamed vars and format
go ahead, bluhm@
Update p5-DBIx-Class-Schema-Loader to 0.07053
With the caveat that there is a mariadb bug that causes a crash
when running the test suite.
https://jira.mariadb.org/browse/MDEV-41221
Revert "Unlink multicast records when their interface is detached"
This reverts commit e7ea118a97a35e10ded68a7d07d4f39e3e7f57b4.
Opened a new problem instead of the old ones. Need a better fix.
bluhm@ asked for the revert which I take as implicit OK.
Reported-by: syzbot+68c8b44ea4717240232d at syzkaller.appspotmail.com
Reject non-conformant certificate subject encodings
Background:
Even though RFC 6487 section 4 is clear: "The CommonName attribute MUST
be encoded using the ASN.1 type PrintableString", some large CAs for
many years incorrectly issued certificates with UTF8String encodings
owing to a documentation bug in OpenSSL:
https://github.com/openssl/openssl/pull/23699
AfriNIC recently announced the completion of a multi-year project to
reissue all non-conformant certificates, see their final update here:
https://lists.afrinic.net/pipermail/dbwg/2026-August/000582.html
This work cleared a major hurdle for RP implementations to impose
stricter validation, in turn positively impacting the overall ecosystem
because requirement baselining and adherence to standards leads to
improved interoperability.
[14 lines not shown]
libcrypto: pass open args as argv list in perlasm scripts
This prevents arguments to xlate from being split, and improves argument
handling when filepaths contain spaces or other special characters.
Inspired a similar fix in BoringSSL
Reported by Meithal on libressl/portable (thanks!)
ok jsing
libcrypto/objects: die when obj_mac.num entry is missing in objects.txt
Instead of reserving the number and generating an out-of-sync obj_mac.h
file, die.
ok tb jsing
Provide both the peer's unverified bundle, and the verified chain.
Our tls_peer_cert_chain_pem was always the full bundle of unverified
certificates sent by the peer, which can certainly violate the
principle of least astonishment.
Provide tls_peer_cert_bundle_unverified_pem and
tls_peer_cert_chain_verified_pem and adjust the documentation for both
to indicate what they are returning.
We also indicate that tls_peer_cert_chain_pem returns the unverified bundle
and may go away in a future release.
