File openssl-Allow-disabling-of-SHA1-signatures.patch of Package openssl-3

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-Allow-disabling-of-SHA1-signatures.patch of Package openssl-3 (Revision 5e49e2b1bfe138766c2d5679e26292eb)

Currently displaying revision 5e49e2b1bfe138766c2d5679e26292eb , Show latest

From 2e8388e06eafb703aeb315498915bf079561bdb5 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Mon, 21 Aug 2023 13:07:07 +0200
Subject: 0049-Allow-disabling-of-SHA1-signatures.patch

Patch-name: 0049-Allow-disabling-of-SHA1-signatures.patch
Patch-id: 49
Patch-status: |
    # Selectively disallow SHA1 signatures rhbz#2070977
From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd
---
 crypto/context.c                              | 14 ++++
 crypto/evp/evp_cnf.c                          | 13 +++
 crypto/evp/m_sigver.c                         | 79 +++++++++++++++++++
 crypto/evp/pmeth_lib.c                        | 15 ++++
 doc/man5/config.pod                           | 13 +++
 include/crypto/context.h                      |  3 +
 include/internal/cryptlib.h                   |  3 +-
 include/internal/sslconf.h                    |  4 +
 providers/common/securitycheck.c              | 20 +++++
 providers/common/securitycheck_default.c      |  9 ++-
 providers/implementations/signature/dsa_sig.c | 11 ++-
 .../implementations/signature/ecdsa_sig.c     |  4 +
 providers/implementations/signature/rsa_sig.c | 20 ++++-
 ssl/t1_lib.c                                  |  8 ++
 util/libcrypto.num                            |  2 +
 15 files changed, 209 insertions(+), 9 deletions(-)

Index: openssl-3.1.4/crypto/context.c
===================================================================
--- openssl-3.1.4.orig/crypto/context.c
+++ openssl-3.1.4/crypto/context.c
@@ -78,6 +78,8 @@ struct ossl_lib_ctx_st {
     void *fips_prov;
 #endif
 
+    void *legacy_digest_signatures;
+
     unsigned int ischild:1;
 };
 
@@ -206,6 +208,10 @@ static int context_init(OSSL_LIB_CTX *ct
         goto err;
 #endif
 
+    ctx->legacy_digest_signatures = ossl_ctx_legacy_digest_signatures_new(ctx);
+    if (ctx->legacy_digest_signatures == NULL)
+        goto err;
+
     /* Low priority. */
 #ifndef FIPS_MODULE
     ctx->child_provider = ossl_child_prov_ctx_new(ctx);
@@ -334,6 +340,11 @@ static void context_deinit_objs(OSSL_LIB
     }
 #endif
 
+    if (ctx->legacy_digest_signatures != NULL) {
+        ossl_ctx_legacy_digest_signatures_free(ctx->legacy_digest_signatures);
+        ctx->legacy_digest_signatures = NULL;
+    }
+
     /* Low priority. */
 #ifndef FIPS_MODULE
     if (ctx->child_provider != NULL) {
@@ -625,6 +636,9 @@ void *ossl_lib_ctx_get_data(OSSL_LIB_CTX
         return ctx->fips_prov;
 #endif
 
+    case OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES_INDEX:
+        return ctx->legacy_digest_signatures;
+
     default:
         return NULL;
     }
Index: openssl-3.1.4/crypto/evp/evp_cnf.c
===================================================================
--- openssl-3.1.4.orig/crypto/evp/evp_cnf.c
+++ openssl-3.1.4/crypto/evp/evp_cnf.c
@@ -10,6 +10,7 @@
 #include <stdio.h>
 #include <openssl/crypto.h>
 #include "internal/cryptlib.h"
+#include "internal/sslconf.h"
 #include <openssl/conf.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
@@ -57,6 +58,18 @@ static int alg_module_init(CONF_IMODULE
                 ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
                 return 0;
             }
+        } else if (strcmp(oval->name, "rh-allow-sha1-signatures") == 0) {
+            int m;
+
+            /* Detailed error already reported. */
+            if (!X509V3_get_value_bool(oval, &m))
+                return 0;
+
+            if (!ossl_ctx_legacy_digest_signatures_allowed_set(
+                    NCONF_get0_libctx((CONF *)cnf), m > 0, 0)) {
+                ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
+                return 0;
+            }
         } else {
             ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION,
                            "name=%s, value=%s", oval->name, oval->value);
Index: openssl-3.1.4/crypto/evp/m_sigver.c
===================================================================
--- openssl-3.1.4.orig/crypto/evp/m_sigver.c
+++ openssl-3.1.4/crypto/evp/m_sigver.c
@@ -15,6 +15,69 @@
 #include "internal/provider.h"
 #include "internal/numbers.h"   /* includes SIZE_MAX */
 #include "evp_local.h"
+#include "crypto/context.h"
+
+typedef struct ossl_legacy_digest_signatures_st {
+    int allowed;
+} OSSL_LEGACY_DIGEST_SIGNATURES;
+
+void ossl_ctx_legacy_digest_signatures_free(void *vldsigs)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs = vldsigs;
+
+    if (ldsigs != NULL) {
+        OPENSSL_free(ldsigs);
+    }
+}
+
+void *ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX *ctx)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES* ldsigs = OPENSSL_zalloc(sizeof(OSSL_LEGACY_DIGEST_SIGNATURES));
+    /* Default to allow SHA-1 and support disabling it via config. */
+    ldsigs->allowed = 1;
+    return ldsigs;
+}
+
+static OSSL_LEGACY_DIGEST_SIGNATURES *ossl_ctx_legacy_digest_signatures(
+        OSSL_LIB_CTX *libctx, int loadconfig)
+{
+#ifndef FIPS_MODULE
+    if (loadconfig && !OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL))
+        return NULL;
+#endif
+
+    return ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES_INDEX);
+}
+
+int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs
+        = ossl_ctx_legacy_digest_signatures(libctx, loadconfig);
+
+#ifndef FIPS_MODULE
+    if (ossl_safe_getenv("OPENSSL_ENABLE_SHA1_SIGNATURES") != NULL)
+        /* This is to be used in tests if SHA-1 is disabled. */
+        return 1;
+#endif
+
+    /* Default to allow SHA-1 and support disabling it via config. */
+    return ldsigs != NULL ? ldsigs->allowed : 1;
+}
+
+int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow,
+                                                  int loadconfig)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs
+        = ossl_ctx_legacy_digest_signatures(libctx, loadconfig);
+
+    if (ldsigs == NULL) {
+        ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
+        return 0;
+    }
+
+    ldsigs->allowed = allow;
+    return 1;
+}
 
 #ifndef FIPS_MODULE
 
@@ -251,6 +314,18 @@ static int do_sigver_init(EVP_MD_CTX *ct
         }
     }
 
+    if (ctx->reqdigest != NULL
+            && !EVP_PKEY_is_a(locpctx->pkey, SN_hmac)
+            && !EVP_PKEY_is_a(locpctx->pkey, SN_tls1_prf)
+            && !EVP_PKEY_is_a(locpctx->pkey, SN_hkdf)) {
+        int mdnid = EVP_MD_nid(ctx->reqdigest);
+        if (!ossl_ctx_legacy_digest_signatures_allowed(locpctx->libctx, 0)
+                && (mdnid == NID_sha1 || mdnid == NID_md5_sha1)) {
+            ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST);
+            goto err;
+        }
+    }
+
     if (ver) {
         if (signature->digest_verify_init == NULL) {
             ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
Index: openssl-3.1.4/crypto/evp/pmeth_lib.c
===================================================================
--- openssl-3.1.4.orig/crypto/evp/pmeth_lib.c
+++ openssl-3.1.4/crypto/evp/pmeth_lib.c
@@ -33,6 +33,7 @@
 #include "internal/ffc.h"
 #include "internal/numbers.h"
 #include "internal/provider.h"
+#include "internal/sslconf.h"
 #include "evp_local.h"
 
 #ifndef FIPS_MODULE
@@ -959,6 +960,20 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_
         return -2;
     }
 
+    if (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
+            && md != NULL
+            && ctx->pkey != NULL
+            && !EVP_PKEY_is_a(ctx->pkey, SN_hmac)
+            && !EVP_PKEY_is_a(ctx->pkey, SN_tls1_prf)
+            && !EVP_PKEY_is_a(ctx->pkey, SN_hkdf)) {
+        int mdnid = EVP_MD_nid(md);
+        if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1)
+                && !ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0)) {
+            ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST);
+            return -1;
+        }
+    }
+
     if (fallback)
         return EVP_PKEY_CTX_ctrl(ctx, -1, op, ctrl, 0, (void *)(md));
 
Index: openssl-3.1.4/doc/man5/config.pod
===================================================================
--- openssl-3.1.4.orig/doc/man5/config.pod
+++ openssl-3.1.4/doc/man5/config.pod
@@ -304,6 +304,21 @@ Within the algorithm properties section,
 The value may be anything that is acceptable as a property query
 string for EVP_set_default_properties().
 
+=item B<rh-allow-sha1-signatures>
+
+The value is a boolean that can be B<yes> or B<no>.  If the value is not set,
+it behaves as if it was set to B<yes>.
+
+When set to B<no>, any attempt to create or verify a signature with a SHA1
+digest will fail.  To test whether your software will work with future versions
+of OpenSSL, set this option to B<no>.  This setting also affects TLS, where
+signature algorithms that use SHA1 as digest will no longer be supported if
+this option is set to B<no>.  Because TLS 1.1 or lower use MD5-SHA1 as
+pseudorandom function (PRF) to derive key material, disabling
+B<rh-allow-sha1-signatures> requires the use of TLS 1.2 or newer.
+
+This is a downstream specific option, and normally it should be set up via crypto-policies.
+
 =item B<fips_mode> (deprecated)
 
 The value is a boolean that can be B<yes> or B<no>.  If the value is
Index: openssl-3.1.4/include/crypto/context.h
===================================================================
--- openssl-3.1.4.orig/include/crypto/context.h
+++ openssl-3.1.4/include/crypto/context.h
@@ -40,3 +40,6 @@ void ossl_rand_crng_ctx_free(void *);
 void ossl_thread_event_ctx_free(void *);
 void ossl_fips_prov_ossl_ctx_free(void *);
 void ossl_release_default_drbg_ctx(void);
+
+void *ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX *);
+void ossl_ctx_legacy_digest_signatures_free(void *);
Index: openssl-3.1.4/include/internal/cryptlib.h
===================================================================
--- openssl-3.1.4.orig/include/internal/cryptlib.h
+++ openssl-3.1.4/include/internal/cryptlib.h
@@ -178,7 +178,8 @@ typedef struct ossl_ex_data_global_st {
 # define OSSL_LIB_CTX_PROVIDER_CONF_INDEX           16
 # define OSSL_LIB_CTX_BIO_CORE_INDEX                17
 # define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX          18
-# define OSSL_LIB_CTX_MAX_INDEXES                   19
+# define OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES_INDEX 19
+# define OSSL_LIB_CTX_MAX_INDEXES                   20
 
 OSSL_LIB_CTX *ossl_lib_ctx_get_concrete(OSSL_LIB_CTX *ctx);
 int ossl_lib_ctx_is_default(OSSL_LIB_CTX *ctx);
Index: openssl-3.1.4/include/internal/sslconf.h
===================================================================
--- openssl-3.1.4.orig/include/internal/sslconf.h
+++ openssl-3.1.4/include/internal/sslconf.h
@@ -18,4 +18,8 @@ int conf_ssl_name_find(const char *name,
 void conf_ssl_get_cmd(const SSL_CONF_CMD *cmd, size_t idx, char **cmdstr,
                       char **arg);
 
+/* Methods to support disabling all signatures with legacy digests */
+int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig);
+int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow,
+                                                  int loadconfig);
 #endif
Index: openssl-3.1.4/providers/common/securitycheck.c
===================================================================
--- openssl-3.1.4.orig/providers/common/securitycheck.c
+++ openssl-3.1.4/providers/common/securitycheck.c
@@ -19,6 +19,7 @@
 #include <openssl/core_names.h>
 #include <openssl/obj_mac.h>
 #include "prov/securitycheck.h"
+#include "internal/sslconf.h"
 
 /*
  * FIPS requires a minimum security strength of 112 bits (for encryption or
@@ -243,6 +244,14 @@ int ossl_digest_get_approved_nid_with_sh
             mdnid = -1; /* disallowed by security checks */
     }
 # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */
+
+#ifndef FIPS_MODULE
+    if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))
+        /* SHA1 is globally enabled by default, check whether we want to locally disable it. */
+        if (mdnid == NID_sha1 && !sha1_allowed)
+            mdnid = -1;
+#endif
+
     return mdnid;
 }
 
@@ -252,5 +261,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX
     if (ossl_securitycheck_enabled(ctx))
         return ossl_digest_get_approved_nid(md) != NID_undef;
 # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */
+
+#ifndef FIPS_MODULE
+    {
+        int mdnid = EVP_MD_nid(md);
+        if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1)
+                && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))
+            return 0;
+    }
+#endif
+
     return 1;
 }
Index: openssl-3.1.4/providers/common/securitycheck_default.c
===================================================================
--- openssl-3.1.4.orig/providers/common/securitycheck_default.c
+++ openssl-3.1.4/providers/common/securitycheck_default.c
@@ -15,6 +15,7 @@
 #include <openssl/obj_mac.h>
 #include "prov/securitycheck.h"
 #include "internal/nelem.h"
+#include "internal/sslconf.h"
 
 /* Disable the security checks in the default provider */
 int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx)
@@ -29,9 +30,10 @@ int ossl_tls1_prf_ems_check_enabled(OSSL
 }
 
 int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md,
-                                    ossl_unused int sha1_allowed)
+                                    int sha1_allowed)
 {
     int mdnid;
+    int ldsigs_allowed;
 
     static const OSSL_ITEM name_to_nid[] = {
         { NID_md5,       OSSL_DIGEST_NAME_MD5       },
@@ -42,8 +44,11 @@ int ossl_digest_rsa_sign_get_md_nid(OSSL
         { NID_ripemd160, OSSL_DIGEST_NAME_RIPEMD160 },
     };
 
-    mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, 1);
+    ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx, 0);
+    mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, sha1_allowed || ldsigs_allowed);
     if (mdnid == NID_undef)
         mdnid = ossl_digest_md_to_nid(md, name_to_nid, OSSL_NELEM(name_to_nid));
+    if (mdnid == NID_md5_sha1 && !ldsigs_allowed)
+        mdnid = -1;
     return mdnid;
 }
Index: openssl-3.1.4/providers/implementations/signature/dsa_sig.c
===================================================================
--- openssl-3.1.4.orig/providers/implementations/signature/dsa_sig.c
+++ openssl-3.1.4/providers/implementations/signature/dsa_sig.c
@@ -123,12 +123,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ct
         mdprops = ctx->propq;
 
     if (mdname != NULL) {
-        int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
         WPACKET pkt;
         EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
-        int md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
-                                                            sha1_allowed);
+        int md_nid;
         size_t mdname_len = strlen(mdname);
+#ifdef FIPS_MODULE
+        int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
+#else
+        int sha1_allowed = 0;
+#endif
+        md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
+                                                            sha1_allowed);
 
         if (md == NULL || md_nid < 0) {
             if (md == NULL)
Index: openssl-3.1.4/providers/implementations/signature/ecdsa_sig.c
===================================================================
--- openssl-3.1.4.orig/providers/implementations/signature/ecdsa_sig.c
+++ openssl-3.1.4/providers/implementations/signature/ecdsa_sig.c
@@ -237,7 +237,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX
                        "%s could not be fetched", mdname);
         return 0;
     }
+#ifdef FIPS_MODULE
     sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
+#else
+    sha1_allowed = 0;
+#endif
     md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
                                                     sha1_allowed);
     if (md_nid < 0) {
Index: openssl-3.1.4/providers/implementations/signature/rsa_sig.c
===================================================================
--- openssl-3.1.4.orig/providers/implementations/signature/rsa_sig.c
+++ openssl-3.1.4/providers/implementations/signature/rsa_sig.c
@@ -25,6 +25,7 @@
 #include "internal/cryptlib.h"
 #include "internal/nelem.h"
 #include "internal/sizes.h"
+#include "internal/sslconf.h"
 #include "crypto/rsa.h"
 #include "prov/providercommon.h"
 #include "prov/implementations.h"
@@ -33,6 +34,7 @@
 #include "prov/securitycheck.h"
 
 #define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1
+#define RSA_DEFAULT_DIGEST_NAME_NONLEGACY OSSL_DIGEST_NAME_SHA2_256
 
 OSSL_FUNC_signature_newctx_fn rsa_newctx;
 static OSSL_FUNC_signature_sign_init_fn rsa_sign_init;
@@ -302,10 +304,15 @@ static int rsa_setup_md(PROV_RSA_CTX *ct
 
     if (mdname != NULL) {
         EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
+        int md_nid;
+        size_t mdname_len = strlen(mdname);
+#ifdef FIPS_MODULE
         int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
-        int md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
+#else
+        int sha1_allowed = 0;
+#endif
+        md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
                                                      sha1_allowed);
-        size_t mdname_len = strlen(mdname);
 
         if (md == NULL
             || md_nid <= 0
@@ -1386,8 +1393,15 @@ static int rsa_set_ctx_params(void *vprs
     prsactx->pad_mode = pad_mode;
 
     if (prsactx->md == NULL && pmdname == NULL
-        && pad_mode == RSA_PKCS1_PSS_PADDING)
+        && pad_mode == RSA_PKCS1_PSS_PADDING) {
         pmdname = RSA_DEFAULT_DIGEST_NAME;
+#ifndef FIPS_MODULE
+        if (!ossl_ctx_legacy_digest_signatures_allowed(prsactx->libctx, 0)) {
+            pmdname = RSA_DEFAULT_DIGEST_NAME_NONLEGACY;
+        }
+#endif
+    }
+
 
     if (pmgf1mdname != NULL
         && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))
Index: openssl-3.1.4/ssl/t1_lib.c
===================================================================
--- openssl-3.1.4.orig/ssl/t1_lib.c
+++ openssl-3.1.4/ssl/t1_lib.c
@@ -20,6 +20,7 @@
 #include <openssl/bn.h>
 #include <openssl/provider.h>
 #include <openssl/param_build.h>
+#include "internal/sslconf.h"
 #include "internal/nelem.h"
 #include "internal/sizes.h"
 #include "internal/tlsgroups.h"
@@ -1172,11 +1173,13 @@ int ssl_setup_sig_algs(SSL_CTX *ctx)
         = OPENSSL_malloc(sizeof(*lu) * OSSL_NELEM(sigalg_lookup_tbl));
     EVP_PKEY *tmpkey = EVP_PKEY_new();
     int ret = 0;
+    int ldsigs_allowed;
 
     if (cache == NULL || tmpkey == NULL)
         goto err;
 
     ERR_set_mark();
+    ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0);
     for (i = 0, lu = sigalg_lookup_tbl;
          i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
         EVP_PKEY_CTX *pctx;
@@ -1196,6 +1199,11 @@ int ssl_setup_sig_algs(SSL_CTX *ctx)
             cache[i].enabled = 0;
             continue;
         }
+        if ((lu->hash == NID_sha1 || lu->hash == NID_md5_sha1)
+                && !ldsigs_allowed) {
+            cache[i].enabled = 0;
+            continue;
+        }
 
         if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {
             cache[i].enabled = 0;
Index: openssl-3.1.4/util/libcrypto.num
===================================================================
--- openssl-3.1.4.orig/util/libcrypto.num
+++ openssl-3.1.4/util/libcrypto.num
@@ -5439,3 +5439,5 @@ X509_get_default_cert_uri
 X509_get_default_cert_uri_env           ?	3_1_0	EXIST::FUNCTION:
 X509_get_default_cert_path_env          ?	3_1_0	EXIST::FUNCTION:
 ossl_safe_getenv                        ?	3_0_0	EXIST::FUNCTION:
+ossl_ctx_legacy_digest_signatures_allowed ?	3_0_1	EXIST::FUNCTION:
+ossl_ctx_legacy_digest_signatures_allowed_set ?	3_0_1	EXIST::FUNCTION:

Places

File openssl-Allow-disabling-of-SHA1-signatures.patch of Package openssl-3 (Revision 5e49e2b1bfe138766c2d5679e26292eb)

Places