openbsd/src/lib, branch master

Add FIPS 180-4 references for SHA-256 constants.

2026-04-25T05:47:03+00:00

Simplify PKCS7_get_issuer_and_serial()

2026-04-24T15:10:20+00:00

The i variable is unused. Likewise for the first assignment to ri. Instead of an incomplete check that idx is in range, which still results in a NULL deref if idx < 0, check if ri is not NULL before accessing, as sk_value() checks the index correctly. ok jsing kenjiro

mlkem: use instead of "mlkem.h"

2026-04-20T08:14:29+00:00

patch from portable

tls_keypair: add missing

2026-04-20T04:35:00+00:00

from bcook kenjiro

ec_pmeth: fix 20yo comment: outlen -> keylen

2026-04-20T04:26:12+00:00

libtls: consistently handle allocation failures

2026-04-16T07:35:25+00:00

Use tls_set_errorx() or tls_error_setx() rather than the versions without x for TLS_ERROR_OUT_OF_MEMORY. ENOMEM adds no further info. From Michael Forney ok bcook

libtls: use TLS_ERROR_OUT_OF_MEMORY after malloc failure

2026-04-16T07:33:11+00:00

tls_config_load_file() hat a spot that used TLS_ERROR_UNKNOWN, so switch that to the usual error code. Use tls_error_setx() since strerror(ENOMEM) adds nothing. From Michael Forney ok bcook

libtls: use tls_error_setx() after BIO_new_mem_buf()

2026-04-16T07:29:53+00:00

This is the only place where tls_error_set() was used. While the new length check now guarantees that the failure is due to ENOMEM, this info does not add value. From Michael Forney ok bcook

libtls: prefer x version of error setting

2026-04-16T07:28:00+00:00

If a check fails and errno is not necessarily set by the previous API call use tls_set_errorx() or tls_error_setx() since turning an unrelated errno into an error string is unhelpful. From Michael Forney ok bcook

libtls: add missing length checks before BIO_new_mem_buf()

2026-04-16T05:16:48+00:00

Like all proper libcrypto APIs, BIO_new_mem_buf() takes an int as a length argument. Check the size_t passed in to be at most INT_MAX to avoid issues with truncation and overflow like it's done everywhere else. After release this should probably be clamped down further since legitimate files (certs and keys) are nowhere near this large. Prompted by a diff by Michael Forney ok jsing