openbsd/src/regress, branch master

wycheproof: skip BLS test vectors to prepare for update

2026-04-21T20:55:21+00:00

pkcs7test: factor main into a helper so we can add some unit tests easily

2026-04-21T05:18:35+00:00

keypairtest: zero out tls_error before running tests

2026-04-15T20:13:07+00:00

Otherwise tls_error_clear() (called e.g. via tls_error_vset()) will free the bad error->msg pointer. From Michael Forney

Prior to this we substring matched and allowed a leading .

2026-04-13T17:04:23+00:00

on a SAN DNSname constraint. This is not correct, as with a DNSname constraint, it may exacly match or match zero or more additional components on the front of the candidte to match. Spotted by Haruto Kimura ok tb@ kenjiro@

Fix min vs max in failure output.

2026-04-03T07:40:14+00:00

Use DTLS_client_method() instead of DTLSv1_client_method().

2026-04-03T07:37:52+00:00

Adjust depth check to match change in verifier.

2026-04-01T14:39:11+00:00

Add additional X.509 verifier test cases.

2026-03-31T13:39:48+00:00

The second case (14b) currently triggers a bug in the new verifier.

Run new test certificate bundles through Go's verifier.

2026-03-31T13:37:45+00:00

Add additional certificate test bundles.

2026-03-31T13:37:11+00:00