From c7810630ba9823137bac2dbbb150d43088de37d6 Mon Sep 17 00:00:00 2001
From: kenjiro <>
Date: Fri, 31 Jul 2026 06:32:34 +0000
Subject: callbackfailures: allow specifying the root certificate file

Accept an optional roots file argument while retaining
/etc/ssl/cert.pem as the default. This allows portable regress users
to provide a CA bundle when the default path is unavailable.

ok tb
---
 src/regress/lib/libcrypto/x509/callbackfailures.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

(limited to 'src')

diff --git a/src/regress/lib/libcrypto/x509/callbackfailures.c b/src/regress/lib/libcrypto/x509/callbackfailures.c
index 9230122146..112f936fcb 100644
--- a/src/regress/lib/libcrypto/x509/callbackfailures.c
+++ b/src/regress/lib/libcrypto/x509/callbackfailures.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: callbackfailures.c,v 1.3 2024/08/23 12:56:26 anton Exp $ */
+/* $OpenBSD: callbackfailures.c,v 1.4 2026/07/31 06:32:34 kenjiro Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
@@ -214,9 +214,9 @@ struct verify_cert_test verify_cert_tests[] = {
     (sizeof(verify_cert_tests) / sizeof(*verify_cert_tests))
 
 static int
-verify_cert_test(const char *certs_path, int mode)
+verify_cert_test(const char *certs_path, const char *roots_file, int mode)
 {
-	char *roots_file, *bundle_file, *bundle_file2, *roots_dir;
+	char *bundle_file, *bundle_file2, *roots_dir;
 	struct verify_cert_test *vct;
 	int failed = 0;
 	int chains;
@@ -225,8 +225,6 @@ verify_cert_test(const char *certs_path, int mode)
 	for (i = 0; i < N_VERIFY_CERT_TESTS; i++) {
 		vct = &verify_cert_tests[i];
 
-		if (asprintf(&roots_file, "/etc/ssl/cert.pem") == -1)
-			errx(1, "asprintf");
 		if (asprintf(&bundle_file, "%s/%s/bundle.pem", certs_path,
 		    vct->id) == -1)
 			errx(1, "asprintf");
@@ -270,7 +268,6 @@ verify_cert_test(const char *certs_path, int mode)
 		}
 		fprintf(stderr, "\n");
 
-		free(roots_file);
 		free(bundle_file);
 		free(bundle_file2);
 		free(roots_dir);
@@ -282,17 +279,21 @@ verify_cert_test(const char *certs_path, int mode)
 int
 main(int argc, char **argv)
 {
+	const char *roots_file = "/etc/ssl/cert.pem";
 	int failed = 0;
 
-	if (argc != 2) {
-		fprintf(stderr, "usage: %s <certs_path>\n", argv[0]);
+	if (argc < 2 || argc > 3) {
+		fprintf(stderr, "usage: %s <certs_path> [roots_file]\n",
+		    argv[0]);
 		exit(1);
 	}
+	if (argc == 3)
+		roots_file = argv[2];
 
 	fprintf(stderr, "\n\nTesting legacy x509_vfy\n");
-	failed |= verify_cert_test(argv[1], MODE_LEGACY_VFY);
+	failed |= verify_cert_test(argv[1], roots_file, MODE_LEGACY_VFY);
 	fprintf(stderr, "\n\nTesting modern x509_vfy\n");
-	failed |= verify_cert_test(argv[1], MODE_MODERN_VFY);
+	failed |= verify_cert_test(argv[1], roots_file, MODE_MODERN_VFY);
 
 	return (failed);
 }
-- 
cgit v1.2.3-55-g6feb