aboutsummaryrefslogtreecommitdiffstats
path: root/ext
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'maint-3.2'Kazuki Yamaguchi2024-05-022-4/+22
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.2: Fix modular square root test with LibreSSL >= 3.8 pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smime pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.new cipher: fix buffer overflow in Cipher#update ssl: allow failure on test_connect_certificate_verify_failed_exception_message .github/workflows/test.yml: synchronize with master Only CSR version 1 (encoded as 0) is allowed by PKIX standards test_asn1.rb: Remove the assertions of the time string format without second. test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0 Use EVP_Digest{Sign,Verify} when available Fix performance regression in do_write(s)
| * Merge branch 'maint-3.1' into maint-3.2maint-3.2Kazuki Yamaguchi2024-05-022-4/+22
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.1: Fix modular square root test with LibreSSL >= 3.8 pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smime pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.new cipher: fix buffer overflow in Cipher#update ssl: allow failure on test_connect_certificate_verify_failed_exception_message .github/workflows/test.yml: synchronize with master Only CSR version 1 (encoded as 0) is allowed by PKIX standards test_asn1.rb: Remove the assertions of the time string format without second. test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0 Use EVP_Digest{Sign,Verify} when available Fix performance regression in do_write(s)
| | * Merge branch 'maint-3.0' into maint-3.1Kazuki Yamaguchi2024-05-022-4/+22
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.0: pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smime pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.new cipher: fix buffer overflow in Cipher#update ssl: allow failure on test_connect_certificate_verify_failed_exception_message .github/workflows/test.yml: synchronize with master Only CSR version 1 (encoded as 0) is allowed by PKIX standards test_asn1.rb: Remove the assertions of the time string format without second. test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0 Use EVP_Digest{Sign,Verify} when available Fix performance regression in do_write(s)
| | | * Merge pull request #752 from rhenium/pkcs7-empty-signed-data-19974maint-3.0Kazuki Yamaguchi2024-05-021-1/+7
| | | |\ | | | | | | | | | | Handle missing content in PKCS7
| | | | * pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smimepkcs7-empty-signed-data-19974Jeremy Evans2024-05-011-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [pkuzco: expanded the fix for other content types] [ky: adjusted formatting and the exception type] Co-authored-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: Kazuki Yamaguchi <k@rhe.jp>
| | | | * pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.newJeremy Evans2024-05-011-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes [Bug #19974] [pkuzco: expanded the fix for other content types] [ky: adjusted formatting and the exception type] Co-authored-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: Kazuki Yamaguchi <k@rhe.jp>
| | | * | cipher: fix buffer overflow in Cipher#updateky/cipher-update-fix-buffer-sizeKazuki Yamaguchi2024-05-011-3/+15
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::Cipher#update currently allocates the output buffer with size (input data length)+(the block size of the cipher). This is insufficient for the id-aes{128,192,256}-wrap-pad (AES keywrap with padding) ciphers. They have a block size of 8 bytes, but the output may be up to 15 bytes larger than the input. Use (input data length)+EVP_MAX_BLOCK_LENGTH (== 32) as the output buffer size, instead. OpenSSL doesn't provide a generic way to tell the maximum required buffer size for ciphers, but this is large enough for all algorithms implemented in current versions of OpenSSL. Fixes: https://bugs.ruby-lang.org/issues/20236
| | | * Use EVP_Digest{Sign,Verify} when availableTheo Buehler2024-05-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] LibreSSL 3.4 added EVP_DigestSign() and EVP_DigestVerify(). Use them when available to prepare for the addition of Ed25519 support in LibreSSL 3.7. (cherry picked from commit 475b2bf766d6093370e49abd5dce5436cc0034ca)
* | | | asn1: check error return from i2d_ASN1_TYPE()ky/asn1-check-i2d-errorKazuki Yamaguchi2024-05-021-2/+5
| | | | | | | | | | | | | | | | | | | | i2d_ASN1_TYPE() is not expected to fail, but the return value should be checked.
* | | | Merge pull request #726 from bdewater/digestsKazuki Yamaguchi2024-05-012-4/+33
|\ \ \ \ | | | | | | | | | | Add OpenSSL::Digest.digests to get a list of available digests
| * | | | Update Cipher#name to match Digest#name explanationBart de Water2024-03-151-2/+2
| | | | |
| * | | | Add OpenSSL::Digest.digests to get a list of available digestsBart de Water2024-03-151-2/+31
| | | | |
* | | | | Use www.rfc-editor.org for RFC text.Hiroshi SHIBATA2024-03-282-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We use the following site for that now: * https://tools.ietf.org/ or http * https://datatracker.ietf.org or http Today, IETF said the official site of RFC is www.rfc-editor.org. FYI: https://authors.ietf.org/en/references-in-rfcxml I replaced them to www.rfc-editor.org.
* | | | | Merge pull request #705 from eregon/remove-truffleruby-workardoundBenoit Daloze2024-03-201-8/+1
|\ \ \ \ \ | |/ / / / |/| | | | Revert openssl dir workaround on TruffleRuby
| * | | | Revert "Always respect the openssl prefix chosen by truffle/openssl-prefix ↵Benoit Daloze2023-12-011-8/+1
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | on TruffleRuby" * This reverts commit ca738e7e13570e88eaa9892cbb3dffb330320706. * No longer needed since https://github.com/oracle/truffleruby/issues/3170 was fixed.
* / / / Add support for IO#timeout. (#714)Samuel Williams2024-01-182-2/+14
|/ / / | | | | | | | | | * Add support for IO#timeout.
* | | Merge pull request #677 from rhenium/ky/remove-mdebugKazuki Yamaguchi2023-09-012-112/+0
|\ \ \ | | | | | | | | Remove OSSL_DEBUG compile-time option
| * | | Remove OSSL_DEBUG compile-time optionky/remove-mdebugKazuki Yamaguchi2023-08-312-112/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the OSSL_DEBUG flag and OpenSSL.mem_check_start which is only compiled when the flag is given. They are meant purely for development of Ruby/OpenSSL. OpenSSL.mem_check_start helped us find memory leak bugs in past, but it is no longer working with the recent OpenSSL versions. Let's just remove it now.
* | | | Merge pull request #676 from p8/fix/ocsp-documentationKazuki Yamaguchi2023-08-311-1/+1
|\ \ \ \ | | | | | | | | | | Fix OCSP documentation
| * | | | Fix OCSP documentationPetrik2023-08-311-1/+1
| |/ / / | | | | | | | | | | | | | | | | `port` should be called on the `ocsp_uri` URI instead of `ocsp`, which is just a string.
* / / / x509ext: let X509::ExtensionFactory#create_ext take a dotted OID stringMichael Richardson2023-08-311-5/+11
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | instead of looking of NIDs and then using X509V3_EXT_nconf_nid, instead just pass strings to X509V3_EXT_nconf, which has all the logic for processing dealing with generic extensions also process the oid through ln2nid() to retain compatibility. [rhe: tweaked commit message and added a test case]
* | | ossl_pkey.c: Workaround: Decode with non-zero selections.Jun Aruga2023-08-251-52/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | This is a workaround for the decoding issue in ossl_pkey_read_generic(). The issue happens in the case that a key management provider is different from a decoding provider. Try all the non-zero selections in order, instead of selection 0 for OpenSSL 3 to avoid the issue.
* | | Fix LIBRESSL_VERSION_NUMBER document mistake.Jun Aruga2023-08-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fix the wrong man reference. * According to the LIBRESSL_VERSION_NUMBER(3), the value always ends with 00f. ``` $ man -M /home/jaruga/.local/libressl-6650dce/share/man/ 3 LIBRESSL_VERSION_NUMBER ... DESCRIPTION OPENSSL_VERSION_NUMBER and LIBRESSL_VERSION_NUMBER are numeric release version identifiers. The first two digits contain the major release number, the third and fourth digits the minor release number, and the fifth and sixth digits the fix re‐ lease number. For OpenSSL, the seventh and eight digits contain the patch release number and the final digit is 0 for development, 1 to e for betas 1 to 14, or f for release. For LibreSSL, OPENSSL_VERSION_NUMBER is always 0x020000000, and LIBRESSL_VERSION_NUMBER always ends with 00f. ```
* | | Merge pull request #640 from ↵Kazuki Yamaguchi2023-08-161-40/+40
|\ \ \ | | | | | | | | | | | | | | | | rhenium/ky/ssl-connect-verify-error-ssl-error-syscall ssl: adjust "certificate verify failed" error on SSL_ERROR_SYSCALL
| * | | ssl: adjust "certificate verify failed" error on SSL_ERROR_SYSCALLKazuki Yamaguchi2023-06-071-25/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enrich SSLError's message with the low-level certificate verification result, even if SSL_get_error() returns SSL_ERROR_SYSCALL. This is currently done on SSL_ERROR_SSL only. According to the man page of SSL_get_error(), SSL_ERROR_SYSCALL may be returned for "other errors, check the error queue for details". This apparently means we have to treat SSL_ERROR_SYSCALL, if errno is not set, as equivalent to SSL_ERROR_SSL.
| * | | ssl: adjust styles of ossl_start_ssl()Kazuki Yamaguchi2023-06-071-36/+36
| | | | | | | | | | | | | | | | | | | | Expand tabs, insert some spaces, and adjust indentation of switch-case to match Ruby's style.
* | | | Merge pull request #645 from rhenium/ky/pkey-document-traditional-pemKazuki Yamaguchi2023-08-167-52/+243
|\ \ \ \ | | | | | | | | | | [DOC] enhance RDoc for exporting pkeys
| * | | | [DOC] enhance RDoc for exporting pkeysky/pkey-document-traditional-pemKazuki Yamaguchi2023-07-025-26/+219
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Describe the behavior of OpenSSL::PKey::{DH,DSA,EC,RSA}#to_pem and #to_der more clearly. They return a different result depending on whether the pkey is a public or private key. This was not documented adequately. Also, suggest the use of OpenSSL::PKey::PKey#private_to_pem and #public_to_pem instead, if possible.
| * | | | [DOC] prefer PKey#private_to_pem and #public_to_pem in RDocKazuki Yamaguchi2023-07-021-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Suggest the use of OpenSSL::PKey::PKey#private_to_pem and #public_to_pem in the top-level documentation. For new programs, these are recommended over OpenSSL::PKey::RSA#export (also aliased as #to_s and #to_pem) unless there is a specific reason to use it, i.e., unless the PKCS#1 output format specifically is required. The output format of OpenSSL::PKey::RSA#export depends on whether the key is a public key or a private key, which is very counter-intuitive. Additionally, when called with arguments to encrypt a private key, as in this example, OpenSSL's own, non-standard format is used. The man page of PEM_write_bio_PrivateKey_traditional(3) in OpenSSL 1.1.1 or later states that it "should only be used for compatibility with legacy programs".
| * | | | [DOC] prefer "password" to "passphrase"Kazuki Yamaguchi2023-07-023-21/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's consistently use the word "password". Although they are considered synonymous, the mixed usage in the rdoc can cause confusion. OpenSSL::KDF.scrypt is an exception. This is because RFC 7914 refers to the input parameter as "passphrase".
* | | | | Merge pull request #659 from rhenium/ky/ssl-ca-file-ca-path-raiseKazuki Yamaguchi2023-08-161-3/+3
|\ \ \ \ \ | | | | | | | | | | | | ssl: raise SSLError if loading ca_file or ca_path fails
| * | | | | ssl: raise SSLError if loading ca_file or ca_path failsky/ssl-ca-file-ca-path-raiseKazuki Yamaguchi2023-08-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiled with OpenSSL <= 1.1.1, OpenSSL::SSL::SSLContext#setup does not raise an exception on an error return from SSL_CTX_load_verify_locations(), but instead only prints a verbose-mode warning. This is not helpful since it very likely indicates an actual error, such as the specified file not being readable. Also, OpenSSL's error queue is not correctly cleared: $ ruby -w -ropenssl -e'OpenSSL.debug=true; ctx=OpenSSL::SSL::SSLContext.new; ctx.ca_file="bad-path"; ctx.setup; pp OpenSSL.errors' -e:1: warning: can't set verify locations ["error:02001002:system library:fopen:No such file or directory", "error:2006D080:BIO routines:BIO_new_file:no such file", "error:0B084002:x509 certificate routines:X509_load_cert_crl_file: system lib"] The behavior is currently different when compiled with OpenSSL >= 3.0: SSLError is raised if SSL_CTX_load_verify_file() or SSL_CTX_load_verify_dir() fails. This inconsistency was unintentionally introduced by commit 5375a55ffc35 ("ssl: use SSL_CTX_load_verify_{file,dir}() if available", 2020-02-22). However, raising SSLError seems more appropriate in this situation. Let's adjust the OpenSSL <= 1.1.1 code so that it behaves the same way as the OpenSSL >= 3.0 code currently does. Fixes: https://github.com/ruby/openssl/issues/649
* | | | | | Merge pull request #648 from rhenium/ky/error-additional-dataKazuki Yamaguchi2023-08-161-12/+17
|\ \ \ \ \ \ | | | | | | | | | | | | | | Include "additional data" message in OpenSSL errors
| * | | | | | Include "additional data" message in OpenSSL errorsky/error-additional-dataKazuki Yamaguchi2023-08-111-12/+17
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Error entries in the OpenSSL error queue may contain additional contextual information associated with the error, which can be helpful when debugging. This "additional data" is currently only printed to stderr when OpenSSL.debug is enabled. Let's include this in the exception messages raised with ossl_raise(), too. $ ruby -Ilib -ropenssl -e'OpenSSL.debug=true; OpenSSL::SSL::SSLContext.new.ecdh_curves="P-256:not-a-curve"' -e:1: warning: error on stack: error:0A080106:SSL routines:gid_cb:passed invalid argument (group 'not-a-curve' cannot be set) -e:1:in `ecdh_curves=': passed invalid argument (group 'not-a-curve' cannot be set) (OpenSSL::SSL::SSLError) from -e:1:in `<main>'
* / / / / / Enhance printing OpenSSL versions.Jun Aruga2023-08-151-1/+18
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Updated the `OpenSSL::OPENSSL_VERSION_NUMBER` comment explaining the format. * Added the `OpenSSL::LIBRESSL_VERSION_NUMBER` to print LibreSSL version number, in the case that Ruby OpenSSL binding is compiled with LibreSSL. Note `test/openssl/utils.rb#libressl?` is not using this value in it for now. * Update `rake debug` to print the values in a readable way, adding `OpenSSL::OPENSSL_VERSION_NUMBER` and `OpenSSL::LIBRESSL_VERSION_NUMBER`.
* | | | | Raise an error when the specified OpenSSL library directory doesn't exist.Jun Aruga2023-07-251-2/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL built from the source creates the library directory to the `/path/to/openssl_dir/lib64` as a default. In the case, the `bundle exec rake compile -- --with-openssl-dir=<openssl_dir>` cannot compile with the lib64 directory, and may compile with system OpenSSL's libraries unintentionally. This commit is to check this case to avoid linking with an unintentional library directory.
* | | | | Always respect the openssl prefix chosen by truffle/openssl-prefix on ↵Benoit Daloze2023-07-211-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TruffleRuby * See https://github.com/ruby/openssl/issues/650#issuecomment-1645699608
* | | | | [DOC] remove top-level example for OpenSSL::Cipher#pkcs5_keyivgen (#647)Kazuki Yamaguchi2023-07-121-39/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::Cipher#pkcs5_keyivgen should only be used when it is absolutely necessary for compatibility with ancient applications. Having an example can be misleading. We already have another example for OpenSSL::Cipher in which PBKDF2 is used to derive a key. As described in the rdoc of OpenSSL::Cipher#pkcs5_keyivgen, it is compatible with PKCS#5 PBES1 (PKCS#5 v1.5) only when used in combination of a hash function MD2, MD5, or SHA-1, and a cipher DES-CBC or RC2-CBC. This example uses MD5 as the hash function and combines it with AES. This is considered insecure and also using a non-standard technique to derive longer keys.
* | | | | Add support for raw private/public keys (#646)Ryo Kajiwara2023-07-121-0/+132
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add OpenSSL::PKey.new_raw_private_key, #raw_private_key and public equivalents. These methods are useful for importing and exporting keys that support "raw private/public key". Currently, OpenSSL implements X25519/X448 and Ed25519/Ed448 keys. [rhe: rewrote commit message] Co-authored-by: Bart de Water <bartdewater@gmail.com>
* | | | add OpenSSL Provider supportqwyng2023-06-174-0/+222
| | | |
* | | | Merge pull request #639 from rhenium/ky/require-ruby-2.7Kazuki Yamaguchi2023-06-072-22/+0
|\ \ \ \ | | | | | | | | | | Drop support for Ruby 2.6
| * | | | Drop support for Ruby 2.6ky/require-ruby-2.7Kazuki Yamaguchi2023-06-072-22/+0
| |/ / / | | | | | | | | | | | | | | | | Ruby 2.6 has reached EOL on 2022-03. Requiring Ruby 2.7 allows us to use C99 syntax.
* / / / pkey: use unsigned type for bit fieldsky/pkey-fix-warning-single-bit-bitfield-constant-conversionKazuki Yamaguchi2023-06-071-3/+3
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | clang generates a warning: ../../../../ext/openssl/ossl_pkey.c:326:22: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] arg->interrupted = 1; ^ ~ 1 error generated.
* | | Merge pull request #633 from rhenium/ky/extconf-append-flags-lastKazuki Yamaguchi2023-06-071-6/+6
|\ \ \ | | | | | | | | extconf.rb: apply RUBY_OPENSSL_EXT{C,LD}FLAGS after checking features
| * | | extconf.rb: apply RUBY_OPENSSL_EXT{C,LD}FLAGS after checking featuresky/extconf-append-flags-lastKazuki Yamaguchi2023-06-021-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RUBY_OPENSSL_EXTCFLAGS and RUBY_OPENSSL_EXTLDFLAGS have been added for the primary purpose of appending custom warning flags during development and CI. Since checking programs generated by mkmf may not be completely warning-free, we don't want to apply -Werror that may be supplied from those environment variables.
* | | | Merge pull request #604 from casperisfine/ssl-write-barrierKazuki Yamaguchi2023-06-0223-38/+51
|\ \ \ \ | | | | | | | | | | Implement Write Barrier for all OpenSSL types
| * | | | Implement Write Barrier for all OpenSSL typesJean Boussier2023-06-0123-38/+51
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | The vast majority have no reference so it's just a matter of setting the flags. For the couple exception, they have very little references so it's easy.
* / / / Workaround: Fix OpenSSL::PKey.read that cannot parse PKey in the FIPS mode.Jun Aruga2023-06-011-5/+21
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit is a workaround to avoid the error below that the `OpenSSL::PKey.read` fails with the OpenSSL 3.0 FIPS mode. ``` $ openssl genrsa -out key.pem 4096 $ ruby -e "require 'openssl'; OpenSSL::PKey.read(File.read('key.pem'))" -e:1:in `read': Could not parse PKey (OpenSSL::PKey::PKeyError) from -e:1:in `<main>' ``` The root cause is on the OpenSSL side. The `OSSL_DECODER_CTX_set_selection` doesn't apply the selection value properly if there are multiple providers, and a provider (e.g. "base" provider) handles the decoder implementation, and another provider (e.g. "fips" provider) handles the keys. The workaround is to create `OSSL_DECODER_CTX` variable each time without using the `OSSL_DECODER_CTX_set_selection`.
* | | Append flags from environment variables.Jun Aruga2023-05-311-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the `mkmf.rb#init_mkmf`, there are command line options below. * `--with-cflags` to set the `cflags` * `--with-ldflags` to set the `ldflags` For example the following command compiles with the specified flags. Note that `MAKEFLAGS` is to print the compiler command lines. ``` $ MAKEFLAGS="V=1" \ bundle exec rake compile -- \ --with-cflags="-Wundef -Werror" \ --with-ldflags="-fstack-protector" ``` However, I couldn't find command line options to append the flags. And this commit is to append the `cflags` and `ldflags` by the environment variables. ``` $ MAKEFLAGS="V=1" \ RUBY_OPENSSL_EXTCFLAGS="-Wundef -Werror" \ RUBY_OPENSSL_EXTLDFLAGS="-fstack-protector" \ bundle exec rake compile ```
* | | Remove usage of IO internals. (#627)Samuel Williams2023-05-292-20/+33
| | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-16 14:41:41 +0000