Merge tag 'v0.8.4' into debian/latest

Release version 0.8.4

10 files changed, 38 insertions, 44 deletions

diff --git a/Changelog b/Changelog
index 5c91365..358c53a 100644
--- a/Changelog
+++ b/Changelog
@@ -1,10 +1,22 @@
+lacme (0.8.4) upstream;
+
+  + accountd: Use PKCS#1 v1.5 signatures, as it's what JWT RS256 uses.
+    This change is needed for compatibility with Crypt::OpenSSL::RSA 0.38
+    and later.
+  + Fix 'drop-privileges' test.
+  + Update test suite to match staging server behavior.
+  + Drop OCSP must-staple extension test which is no longer available on
+    Let's Encrypt's ACME server.
+
+ -- Guilhem Moulin <guilhem@fripost.org>  Mon, 20 Jul 2026 19:52:28 +0200
+
 lacme (0.8.3) upstream;
 
-  + Fix post-issuance validation logic.  We avoid pining the
+  + Fix post-issuance validation logic.  We avoid pinning the
     intermediate certificates in the bundle and instead validate the
     leaf certificate with intermediates supplied during issuance as
     untrusted (used for chain building only).  Only the root
-    certificates are used as trust anchor.  Not pining intermediate
+    certificates are used as trust anchor.  Not pinning intermediate
     certificates is in line with Let's Encrypt's latest recommendations.
   + Pass `-in /dev/stdin` option to openssl(1) to avoid warning with
     OpenSSL 3.2 or later.
diff --git a/client b/client
index 2a5ee3c..be9a7f5 100755
--- a/client
+++ b/client
@@ -43,7 +43,7 @@ use warnings;
 # instance own by another user and created with umask 0177) is not a
 # problem since SOCKET_FD can be bound as root prior to the execve(2).
 
-our $VERSION = '0.8.3';
+our $VERSION = '0.8.4';
 my $PROTOCOL_VERSION = 1;
 my $NAME = 'lacme-client';
 
diff --git a/lacme b/lacme
index 37d3a51..c72628c 100755
--- a/lacme
+++ b/lacme
@@ -22,7 +22,7 @@ use v5.14.2;
 use strict;
 use warnings;
 
-our $VERSION = '0.8.3';
+our $VERSION = '0.8.4';
 my $NAME = 'lacme';
 
 use Errno 'EINTR';
diff --git a/lacme-accountd b/lacme-accountd
index 5bc8b5f..05fa227 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -23,7 +23,7 @@ use v5.14.2;
 use strict;
 use warnings;
 
-our $VERSION = '0.8.3';
+our $VERSION = '0.8.4';
 my $PROTOCOL_VERSION = 1;
 my $NAME = 'lacme-accountd';
 
@@ -174,6 +174,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
     error("$filename: Not a private key") unless $rsa->is_private();
     error("$filename: Invalid key")       unless $rsa->check_key();
     $rsa->use_sha256_hash();
+    $rsa->use_pkcs1_padding(); # JWT RS256 uses PKCS#1 v1.5 signatures
 
     require 'Crypt/OpenSSL/Bignum.pm';
     my ($n, $e) = $rsa->get_key_parameters(); # don't include private params!
diff --git a/tests/accountd-kid b/tests/accountd-kid
index 8a4b53c..e6f5ca4 100644
--- a/tests/accountd-kid
+++ b/tests/accountd-kid
@@ -28,7 +28,7 @@ sleep 1
 # newAccount resource fails as per RFC 8555 sec. 6.2 it requires a JWK
 ! lacme --socket="$SOCKET" account 2>"$STDERR" || fail
 grepstderr -Fxq "Warning: lacme-accountd supplied an empty JWK; try removing 'keyid' setting from lacme-accountd.conf if the ACME resource request fails."
-grepstderr -Fxq "400 Bad Request (Parse error reading JWS)"
+grepstderr -Fxq "400 Bad Request (Unable to validate JWS :: Parse error reading JWS)"
 grep -F "] SIGNED header=base64url({" ~lacme-account/.local/share/lacme/accountd.log >/tmp/signed
 ! grep -vF "] SIGNED header=base64url({\"alg\":\"RS256\",\"jwk\":{}," </tmp/signed
 
@@ -48,7 +48,7 @@ test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
 lacme --socket="$SOCKET" revokeCert /etc/lacme/simpletest.rsa.crt
 ! lacme --socket="$SOCKET" revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail
 grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt"
-grepstderr -Fq "400 Bad Request (unable to revoke"
+grepstderr -Eq "400 Bad Request \\(Unable to revoke :: no certificate with serial [0-9a-fA-F]+ and status other than revoked\\)"
 grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt"
 
 kill $PID
diff --git a/tests/cert-extensions b/tests/cert-extensions
index d7e7855..9c5b977 100644
--- a/tests/cert-extensions
+++ b/tests/cert-extensions
@@ -25,7 +25,7 @@ x509_check /etc/lacme/test1.crt <<-EOF
 	X509v3 Key Usage: critical
 	    Digital Signature, Key Encipherment
 	X509v3 Extended Key Usage:
-	    TLS Web Server Authentication, TLS Web Client Authentication
+	    TLS Web Server Authentication
 	X509v3 Basic Constraints: critical
 	    CA:FALSE
 	X509v3 Subject Alternative Name:
@@ -54,38 +54,11 @@ x509_check /etc/lacme/test2.crt <<-EOF
 	X509v3 Key Usage: critical
 	    Digital Signature, Key Encipherment
 	X509v3 Extended Key Usage:
-	    TLS Web Server Authentication, TLS Web Client Authentication
+	    TLS Web Server Authentication
 	X509v3 Basic Constraints: critical
 	    CA:FALSE
 	X509v3 Subject Alternative Name:
 	    DNS:$(echo "$commonName" "$subjectAltName" | tr " " "\\n" | sort -u | paste -sd" " | sed -r "s/ /, DNS:/g")
 EOF
 
-# tlsfeature
-openssl genpkey -algorithm RSA -out /etc/lacme/test3.key
-commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME"
-cat >"/etc/lacme/lacme-certs.conf.d/test3.conf" <<- EOF
-	[test3]
-	certificate-key = /etc/lacme/test3.key
-	certificate-chain = /etc/lacme/test3.crt
-	subject = /CN=$commonName
-	tlsfeature = status_request
-EOF
-
-lacme newOrder test3
-test /etc/lacme/test3.crt -nt /etc/lacme/test3.key
-x509_check /etc/lacme/test3.crt <<-EOF
-	subject=/CN=$commonName
-	X509v3 Key Usage: critical
-	    Digital Signature, Key Encipherment
-	X509v3 Extended Key Usage:
-	    TLS Web Server Authentication, TLS Web Client Authentication
-	X509v3 Basic Constraints: critical
-	    CA:FALSE
-	X509v3 Subject Alternative Name:
-	    DNS:$commonName
-	TLS Feature:
-	    status_request
-EOF
-
 # vim: set filetype=sh :
diff --git a/tests/cert-revoke b/tests/cert-revoke
index 179ccba..ead6723 100644
--- a/tests/cert-revoke
+++ b/tests/cert-revoke
@@ -18,7 +18,7 @@ test /etc/lacme/simpletest.ecdsa.crt -nt /etc/lacme/simpletest.ecdsa.key
 lacme revokeCert /etc/lacme/simpletest.ecdsa.crt
 ! lacme revokeCert /etc/lacme/simpletest.ecdsa.crt 2>"$STDERR" || fail
 grepstderr -Fxq "Revoking /etc/lacme/simpletest.ecdsa.crt"
-grepstderr -Fq "400 Bad Request (unable to revoke"
+grepstderr -Fq "400 Bad Request (Unable to revoke ::"
 grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.ecdsa.crt"
 
 # and the RSA certificate using the service key
@@ -26,7 +26,7 @@ mv -vfT /etc/lacme/simpletest.rsa.key /etc/lacme/account.key
 lacme revokeCert /etc/lacme/simpletest.rsa.crt
 ! lacme revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail
 grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt"
-grepstderr -Fq "400 Bad Request (unable to revoke"
+grepstderr -Fq "400 Bad Request (Unable to revoke ::"
 grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt"
 
 # vim: set filetype=sh :
diff --git a/tests/cert-verify b/tests/cert-verify
index a6cd336..2138e29 100644
--- a/tests/cert-verify
+++ b/tests/cert-verify
@@ -20,7 +20,7 @@ grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from
 # verification error for unrelated CA bundle
 cat /etc/ssl/certs/ssl-cert-snakeoil.pem >/usr/share/lacme/ca-certificates.crt
 ! lacme newOrder 2>"$STDERR" || fail
-grepstderr -Fxq "error 20 at 1 depth lookup: unable to get local issuer certificate"
+grepstderr -Eq "^error 20 at [1-9][0-9]* depth lookup: unable to get local issuer certificate$"
 grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!"
 
 # use saved bundle as custom CAfile
diff --git a/tests/drop-privileges b/tests/drop-privileges
index 8deb8f1..3589ee3 100644
--- a/tests/drop-privileges
+++ b/tests/drop-privileges
@@ -81,7 +81,8 @@ check_accountd() {
 		USER=lacme-account
 	EOF
 
-    stderr="$(readlink -e "/proc/$$/fd/2")"
+    stderr="$(readlink -f "/proc/$$/fd/2")"
+    test -n "$stderr" || return -1
     socket_ino="$(sed -rn '/^0 .* socket:\[([0-9]+)\]$/ {s//\1/p;q}' "$prefix/fd")"
     [ -n "$socket_ino" ] || return 1
     grep -Fxq "0 0700 $UID:$GID socket:[$socket_ino]" "$prefix/fd" || return 1
@@ -106,8 +107,10 @@ check_client() {
 		USER=_lacme-client
 	EOF
 
-    stdout="$(readlink -e "/proc/$$/fd/1")"
-    stderr="$(readlink -e "/proc/$$/fd/2")"
+    stdout="$(readlink -f "/proc/$$/fd/1")"
+    stderr="$(readlink -f "/proc/$$/fd/2")"
+    test -n "$stdout" || return -1
+    test -n "$stderr" || return -1
     if [ "$command" = "account" ]; then # no pipe
         grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1
         grep -Fxq "1 0700 $UID:$GID $stdout"   "$prefix/fd" || return 1
@@ -143,8 +146,10 @@ check_webserver() {
 		USER=_lacme-www
 	EOF
 
-    stdout="$(readlink -e "/proc/$$/fd/1")"
-    stderr="$(readlink -e "/proc/$$/fd/2")"
+    stdout="$(readlink -f "/proc/$$/fd/1")"
+    stderr="$(readlink -f "/proc/$$/fd/2")"
+    test -n "$stdout" || return -1
+    test -n "$stderr" || return -1
     grep -Fxq "0 0500 $UID:$GID /dev/null"  "$prefix/fd" || return 1
     grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1
     grep -Fxq "2 0700 $UID:$GID $stderr" "$prefix/fd" || return 1
diff --git a/tests/old-accountd b/tests/old-accountd
index 3ad4b31..daa1996 100644
--- a/tests/old-accountd
+++ b/tests/old-accountd
@@ -19,6 +19,9 @@ DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \
     -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \
     lacme-accountd/stretch
 
+# somewhat cheating, but needed for an older accountd using a newer Crypt::OpenSSL::RSA
+sed -ri 's/^\s*\$rsa->use_sha256_hash\(\);$/& $rsa->use_pkcs1_padding();/' /usr/bin/lacme-accountd
+
 SOCKET=~lacme-account/S.lacme
 runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" & PID=$!
 sleep 1