GeezerVison

🤖 get_repo_knowledge executed:

get_repo_knowledge RustPython/RustPython /tmp/coderabbit-repo-knowledge/rustpython-rustpython-3b4170e8/architecture /tmp/coderabbit-repo-knowledge/rustpython-rustpython-3b4170e8/learnings

Length of output: 36331

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- target source ---'
sed -n '620,730p' crates/stdlib/src/ssl/cert.rs
printf '%s\n' '--- related definitions and tests ---'
rg -n -C 4 'load_from_dir|is_capath_hash_name|capath|uppercase|hash name|subject hash|X509_NAME|Trust' crates/stdlib/src/ssl/cert.rs crates/stdlib/src/ssl
printf '%s\n' '--- changed-file summary ---'
git diff --stat -- crates/stdlib/src/ssl/cert.rs

Repository: RustPython/RustPython

Length of output: 14911

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- certificate parsing and store insertion ---'
sed -n '1,330p' crates/stdlib/src/ssl/cert.rs
sed -n '730,860p' crates/stdlib/src/ssl/cert.rs
printf '%s\n' '--- directory-loader callers and capath setup ---'
rg -n -C 6 'load_from_dir|load_verify_locations|capath|CApath|CertLoader' crates/stdlib/src/ssl crates/stdlib
printf '%s\n' '--- capath-related fixtures and tests ---'
rg -n -C 5 'capath|4e1295a3|hash' Lib crates/stdlib extra_tests 2>/dev/null || true

Repository: RustPython/RustPython

Length of output: 50378

🌐 Web query:

OpenSSL X509_LOOKUP_hash_dir by_dir.c subject hash filename lookup semantics

💡 Result:

The OpenSSL X509_LOOKUP_hash_dir method is used for locating and loading certificates and Certificate Revocation Lists (CRLs) from a directory on demand [1][2]. The semantics for filename lookup and handling are as follows: Filename Semantics: The directory must contain files named using the format hash.N for certificates or hash.rN for CRLs [1][3]. The hash component is derived by applying the X509_NAME_hash_ex function (or X509_NAME_hash in older versions) to the subject name of the certificate or the issuer name of the CRL [1][2]. Sequence Numbers (N): The.N or.rN suffix represents a sequence number starting at zero [1][4]. This suffix allows for the storage of multiple certificates with the same subject name hash in the same directory [1][2]. OpenSSL iterates through these files sequentially starting from N=0 [1][3]. Lookup Behavior: 1. On-Demand Loading: Files are loaded into memory only when needed and subsequently cached [1][5]. 2. Sequential Scanning: OpenSSL assumes that the sequence numbers are consecutive [1][2]. It will attempt to load files in order (e.g.,.0,.1,.2...). 3. Termination of Lookup: Gaps in the sequence are not supported; the lookup process assumes there are no more objects with a given hash once it encounters a missing number in the sequence [1][6]. 4. CRLs: When checking for newer CRLs for a previously loaded hash, the method limits its check to files with a sequence number greater than the currently cached CRL [1][3]. To ensure correct operation, especially when multiple certificates share the same subject name hash, the files must be explicitly named with these sequential numbers [1][2]. The openssl-rehash(1) utility is the standard tool for generating these symlinks automatically for PEM files in a directory [1][3]. If distinct certificates exist with the same subject name, utilizing Subject Key Identifiers (SKID) and Authority Key Identifiers (AKID) is essential for proper identification and verification by OpenSSL, rather than relying solely on subject name matching [7].

Citations:

• 1: https://docs.openssl.org/3.6/man3/X509_LOOKUP_hash_dir/
• 2: https://docs.openssl.org/1.1.1/man3/X509_LOOKUP_hash_dir/
• 3: https://docs.openssl.org/3.3/man3/X509_LOOKUP_hash_dir/
• 4: https://man.openbsd.org/man3/X509_LOOKUP_hash_dir.3
• 5: https://docs.openssl.org/3.4/man3/X509_LOOKUP_hash_dir/
• 6: https://docs.openssl.org/3.2/man3/X509_LOOKUP_hash_dir/
• 7: GitHub issue 16304 in openssl/openssl (link omitted to avoid creating a cross-reference)

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- loader implementation ---'
sed -n '720,825p' crates/stdlib/src/ssl/cert.rs
printf '%s\n' '--- exact directory-loader callers ---'
rg -n -C 10 'load_from_dir' crates/stdlib/src/ssl
printf '%s\n' '--- exact capath API flow ---'
rg -n -C 8 'capath|CApath|verify_locations|load_verify' crates/stdlib/src/ssl
printf '%s\n' '--- certificate hash helpers ---'
rg -n -C 6 'hash.*subject|subject.*hash|X509_NAME_hash|name_hash|openssl' crates/stdlib/src/ssl/cert.rs crates/stdlib/src/ssl

Repository: RustPython/RustPython

Length of output: 39183

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- all CertLoader references ---'
rg -n -C 8 'CertLoader|load_from_dir' .
printf '%s\n' '--- ssl module files and verification entry points ---'
fd -t f . crates/stdlib/src/ssl | sort
rg -n -C 8 'load_verify_locations|cafile|capath|verify_locations|RootCertStore|load_from_file|load_from_bytes' crates/stdlib/src/ssl --glob '*.rs'
printf '%s\n' '--- repository state ---'
git status --short
git diff --stat

Repository: RustPython/RustPython

Length of output: 28487

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- capath cache and trust-store integration ---'
sed -n '800,900p' crates/stdlib/src/ssl.rs
sed -n '900,970p' crates/stdlib/src/ssl.rs
printf '%s\n' '--- capath configuration and use ---'
rg -n -C 10 'capath_state|get_capath|capath_cert|directories' crates/stdlib/src/ssl.rs
printf '%s\n' '--- current uppercase-name test context ---'
sed -n '637,672p' crates/stdlib/src/ssl/cert.rs

Repository: RustPython/RustPython

Length of output: 17160

🌐 Web query:

OpenSSL by_dir.c hash directory filename lowercase %08lx uppercase filenames accepted

💡 Result:

In OpenSSL's hashed directory lookup method, implemented in crypto/x509/by_dir.c, the filename is generated using the format string %08lx [1][2][3]. This format specifier produces an 8-character hexadecimal string representing the hash value [4][5]. Regarding casing, the %lx conversion specifier in C's printf-family functions (such as BIO_snprintf used in OpenSSL) outputs hexadecimal digits in lowercase (a-f) [1][6]. Consequently, OpenSSL expects and generates the hash portion of the filename in lowercase [4][5]. While OpenSSL generates these filenames in lowercase, the acceptance of uppercase filenames depends on the underlying filesystem's case sensitivity. On case-insensitive filesystems (such as FAT32 or NTFS on Windows), uppercase filenames are accepted and treated as equivalent to their lowercase counterparts. On case-sensitive filesystems (such as most Linux/Unix filesystems), the lookup will fail if the file is named using uppercase hex digits because OpenSSL explicitly generates and searches for lowercase filenames [1][3]. In summary: - The hash portion is generated as an 8-digit hexadecimal string using %08lx, which inherently results in lowercase [1][6]. - The utility openssl-rehash is the standard tool for creating these symlinks to ensure the correct naming convention is followed [4][5].

Citations:

• 1: https://github.com/openssl/openssl/blob/master/crypto/x509/by_dir.c
• 2: https://github.com/openssl/openssl/blob/0a5316e4/crypto/x509/by_dir.c
• 3: https://github.com/openssl/openssl/blob/8782e9a7/crypto/x509/by_dir.c
• 4: https://docs.openssl.org/3.2/man3/X509_LOOKUP_hash_dir/
• 5: https://docs.openssl.org/3.5/man3/X509_LOOKUP_hash_dir/
• 6: https://docs.huihoo.com/doxygen/openssl/1.0.1c/by__dir_8c_source.html