openbsd/src/usr.sbin/ocspcheck/ocspcheck.c, branch OPENBSD_6_8_BASE

Ignore ftruncate failure with errno == EAGAIN

2020-09-04T04:17:46+00:00

This makes piping the OCSP response to other programs with -o - work. input and r+ guenther

The X509_LOOKUP code tries to grope around in /etc/ssl/cert/ to find

2020-01-23T03:53:39+00:00

CA certs it couldn't find otherwise. This may lead to a pledge rpath violation reported by Kor, son of Rynar. Unfortunately, providing certs inside a directory is common in linuxes, so we need to keep this functionality for portable. Check if /etc/ssl/cert.pem and /etc/ssl/cert exist and pledge accordingly. Add unveils to restrict this program further on a default OpenBSD install. Fix -C to look only inside the provided root bundle. Input from jsing and sthen, tests by sthen and Kor ok beck, jsing, sthen (after much back and forth)

check result of ftruncate() as we do write() below

2019-05-15T13:44:18+00:00

ok beck@

Avoid using an uninitialized variable.

2017-12-01T14:42:23+00:00

Found by gcc. OK jca@

add -i to SYNOPSIS/usage() and sundry tweaks;

2017-11-29T21:15:45+00:00

ok beck

Add option -i to allow oscpcheck to be used to validate an on-disk staple

2017-11-28T23:32:00+00:00

ok claudio@ benno@

Print size_t's correctly.

2017-05-08T20:15:34+00:00

Fix from Jonas 'Sortie' Termansen

repair knf & whitespace that jumped out of the screen during review

2017-03-27T23:59:08+00:00

ok beck

use a path of "/" if the URL does not include a trailing / - since

2017-03-27T18:26:53+00:00

the web server probably doesn't like it, even though you published the url without the trailing / in the certificate. (hello digicert!) ok claudio@

Fail early if an ocep server returns a non-200 http response, there is no

2017-03-27T18:14:20+00:00

point in trying to parse error pages as an ocsp response.