From fc52c4f391dd6cae1f20ebfc9aefd9f6bc78cfd8 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 20 Jul 2026 19:05:50 +0200
Subject: accountd: Use PKCS#1 v1.5 signatures.

It's what JWT RS256 uses.  Nedded for compatibility with Crypt::OpenSSL
0.38 and later.
---
 lacme-accountd     | 1 +
 tests/old-accountd | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/lacme-accountd b/lacme-accountd
index 5bc8b5f..a0cc15f 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -174,6 +174,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
     error("$filename: Not a private key") unless $rsa->is_private();
     error("$filename: Invalid key")       unless $rsa->check_key();
     $rsa->use_sha256_hash();
+    $rsa->use_pkcs1_padding(); # JWT RS256 uses PKCS#1 v1.5 signatures
 
     require 'Crypt/OpenSSL/Bignum.pm';
     my ($n, $e) = $rsa->get_key_parameters(); # don't include private params!
diff --git a/tests/old-accountd b/tests/old-accountd
index 3ad4b31..daa1996 100644
--- a/tests/old-accountd
+++ b/tests/old-accountd
@@ -19,6 +19,9 @@ DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \
     -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \
     lacme-accountd/stretch
 
+# somewhat cheating, but needed for an older accountd using a newer Crypt::OpenSSL::RSA
+sed -ri 's/^\s*\$rsa->use_sha256_hash\(\);$/& $rsa->use_pkcs1_padding();/' /usr/bin/lacme-accountd
+
 SOCKET=~lacme-account/S.lacme
 runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" & PID=$!
 sleep 1
-- 
cgit v1.2.3