openbsd/src/regress/lib/libcrypto, branch OPENBSD_7_9

Prior to this we substring matched and allowed a leading .

2026-04-13T17:04:23+00:00

on a SAN DNSname constraint. This is not correct, as with a DNSname constraint, it may exacly match or match zero or more additional components on the front of the candidte to match. Spotted by Haruto Kimura ok tb@ kenjiro@

Adjust depth check to match change in verifier.

2026-04-01T14:39:11+00:00

Add additional X.509 verifier test cases.

2026-03-31T13:39:48+00:00

The second case (14b) currently triggers a bug in the new verifier.

Run new test certificate bundles through Go's verifier.

2026-03-31T13:37:45+00:00

Add additional certificate test bundles.

2026-03-31T13:37:11+00:00

Generate two additional certificate test scenarios which have deep chains.

2026-03-31T13:34:25+00:00

Add missing include path required to reach newly added crypto_assembly.h

2026-03-29T06:19:12+00:00

include.

rfc3779 regress: explain where the range comes from

2026-03-13T06:47:34+00:00

rfc3779 regress: add an actual range

2026-03-13T06:40:56+00:00

This improves the test coverage of make_addressRange() where there is an annoyance with unused bits in the RFC 3779 ASN.1 encoding versus trailing ones in the network encoding that the X509v3_addr_add_range() API expects.

assembly regress: use make's MACHINE_ARCH rather than handrolling it

2026-01-25T14:57:43+00:00

discussed with jsing