From cad781b3e5de615e8a570950e455bd04cdadeafd Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Fri, 9 May 2025 12:29:01 -0400 Subject: [PATCH] Skip RSA-PSS ssl test when using LibreSSL. Presently, LibreSSL does not have working support for RSA-PSS, so disable that test. Per discussion at https://marc.info/?l=libressl&m=174664225002441&w=2 they do intend to fix this, but it's a ways off yet. Reported-by: Thomas Munro Author: Tom Lane Reviewed-by: Daniel Gustafsson Discussion: https://postgr.es/m/CA+hUKG+fLqyweHqFSBcErueUVT0vDuSNWui-ySz3+d_APmq7dw@mail.gmail.com Backpatch-through: 15 --- src/test/ssl/t/002_scram.pl | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl index 28c54bdb09f..b84e12691ed 100644 --- a/src/test/ssl/t/002_scram.pl +++ b/src/test/ssl/t/002_scram.pl @@ -44,14 +44,21 @@ my $SERVERHOSTADDR = '127.0.0.1'; # This is the pattern to use in pg_hba.conf to match incoming connections. my $SERVERHOSTCIDR = '127.0.0.1/32'; +# Determine whether this build uses OpenSSL or LibreSSL. +my $libressl = $ssl_server->is_libressl; + # Determine whether build supports tls-server-end-point. my $supports_tls_server_end_point = check_pg_config("#define HAVE_X509_GET_SIGNATURE_NID 1"); + # Determine whether build supports detection of hash algorithms for # RSA-PSS certificates. my $supports_rsapss_certs = check_pg_config("#define HAVE_X509_GET_SIGNATURE_INFO 1"); +# As of 5/2025, LibreSSL doesn't actually work for RSA-PSS certificates. +$supports_rsapss_certs = 0 if $libressl; + # Allocation of base connection string shared among multiple tests. my $common_connstr;