Align X509_chack_ca() with modern OpenSSL
We have been documenting for quite a while that this API is broken and
that callers need to ensure proper caching of extensions using the usual
X509_check_purpose() trick. Since the API can't indicate errors, choose
to err on the safe side and report a CA only after successful caching of
extensions.
Reported by Frank Denis and others
ok beck, discussed with jsing
ocspcheck: do not use OCSP_TRUSTOTHER
Like in libtls, ensure that the provided OCSP staple is validated by an
OCSP trust chain to the root.
From Acts1631
ok beck kenjiro
libtls: fix OCSP responder authorization bypass
If a CA revokes a valid TLS server cert using OCSP, a client configured to
require a valid OCSP staple should always reject that cert. If the server's
private key has been compromised, it was possible to bypass this requirement.
The problem is the behavior of OCSP_TRUSTOTHER which skips chain
validation for the OCSP trust chain to the root and the checking that
the staple was signed by a CA of the validating chain. So remove this flag.
This only affects callers of tls_config_ocsp_require_stapling(). In OpenBSD
base these are reachable in OpenBSD base via opt-in behaviors of nc(1) -T
and ftp(1) -S via the "muststaple" keyword. No ports call these functions.
Reported by Acts1631 and Jiho Kim
ok beck kenjiro
Update to Ruby 4.0.7
This includes fixes for:
CVE-2026-80212: Memory exhaustion through malicious DNS responses
CVE-2026-80213: Hostname validation bypass
lang/gdmd: update to 20260801
Since gdc in gcc was fixed, it can be linked back to build.
It also works well enough to be used as bootstrap compiler for lang/dmd