summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2024-04-08Add a test for session cache overflowMatt Caswell
Test sessions behave as we expect even in the case that an overflow occurs when adding a new session into the session cache. Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit 4a3e8f08306c64366318e26162ae0a0eb7b1a006)
2024-04-08Hardening around not_resumable sessionsMatt Caswell
Make sure we can't inadvertently use a not_resumable session Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit 21df7f04f6c4a560b4de56d10e1e58958c7e566d)
2024-04-08Add a CHANGES.md/NEWS.md entry for the unbounded memory growth bugMatt Caswell
Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit 03c4b0eab6dcbb59e3f58baad634be8fc798c103)
2024-04-08Fix unconstrained session cache growth in TLSv1.3Matt Caswell
In TLSv1.3 we create a new session object for each ticket that we send. We do this by duplicating the original session. If SSL_OP_NO_TICKET is in use then the new session will be added to the session cache. However, if early data is not in use (and therefore anti-replay protection is being used), then multiple threads could be resuming from the same session simultaneously. If this happens and a problem occurs on one of the threads, then the original session object could be marked as not_resumable. When we duplicate the session object this not_resumable status gets copied into the new session object. The new session object is then added to the session cache even though it is not_resumable. Subsequently, another bug means that the session_id_length is set to 0 for sessions that are marked as not_resumable - even though that session is still in the cache. Once this happens the session can never be removed from the cache. When that object gets to be the session cache tail object the cache never shrinks again and grows indefinitely. CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit 7984fa683e9dfac0cad50ef2a9d5a13330222044)
2024-04-08Extend the multi_resume test for simultaneous resumptionsMatt Caswell
Test what happens if the same session gets resumed multiple times at the same time - and one of them gets marked as not_resumable. Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit cfeaf33a26c53c526128df96db2d2ec105b43aec)
2024-04-08Add a test for session cache handlingMatt Caswell
Repeatedly create sessions to be added to the cache and ensure we never exceed the expected size. Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit 0447cd690f86ce52ff760d55d6064ea0d08656bf)
2024-04-05NonStop: Do not call sleep() with a 0 valueRandall S. Becker
This change ensures that sleep(0) is not invoked to cause unexpected duplicate thread context switches when _REENTRANT is specified. Fixes: #24009 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24012)
2024-04-04Diverse small VMS build fixupsRichard Levitte
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24008)
2024-04-04downgrade upload-artifact action to v3Dmitry Misharov
GitHub Enterpise Server is not compatible with upload-artifact@v4+. https://github.com/actions/upload-artifact/tree/v4 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24029) (cherry picked from commit 089271601a1d085f33ef7b7d8c3b6879045be370)
2024-04-04openssl-crl(1): The -verify option is implied by -CA* optionsTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24024) (cherry picked from commit a16f2e7651b22ee992bb0c279e25164b519c1e80)
2024-04-04DEFINE_STACK_OF.pod: Fix prototypes of sk_TYPE_free/zero()Tomas Mraz
They take non-const STACK_OF(TYPE)* argument. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24023) (cherry picked from commit e898c367312c3ab6eb5eaac9b4be768f0d2e4b0e)
2024-04-04Add 'documentation policy' link to CONTRIBUTING guide.slontis
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23875) (cherry picked from commit e817766c0f46f371fabe344fba60d13afcfc3da9)
2024-04-04Update Documentation for EVP_DigestSign, EVP_DigestVerify.slontis
Fixes #23075 In OpenSSL 3.2 EVP_DigestSign and EVP_DigestVerify were changed so that a flag is set once these functions do a one-shot sign or verify operation. This PR updates the documentation to match the behaviour. Investigations showed that prior to 3.2 different key type behaved differently if multiple calls were done. By accident X25519 and X448 would produce the same signature, but ECDSA and RSA remembered the digest state between calls, so the signature was different when multiple calls were done. Because of this undefined behaviour something needed to be done, so keeping the 'only allow it to be called once' behaviour seems a reasonable approach. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23834) (cherry picked from commit 5e908e6068708c89da7b5591cc65ff4b3d3135d2)
2024-04-04Align 'openssl req' string_mask docs to how the software really worksJob Snijders
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23699) (cherry picked from commit 2410cb42e62c3be69dcf1aad1bdf1eb0233b670f)
2024-04-04Workaround the relocation truncated to fit problem on m68k buildsTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24028) (cherry picked from commit 81b7aa7186bf48fa5c2eaf0c7fe3bd05880e4dbb)
2024-04-03Allow provider sigalgs in SignatureAlgorithms confAlex Bozarth
Though support for provider-based signature algorithms was added in ee58915 this functionality did not work with the SignatureAlgorithms configuration command. If SignatureAlgorithms is set then the provider sigalgs are not used and instead it used the default value. This PR adds a check against the provider-base sigalg list when parsing the SignatureAlgorithms value. Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com> Fixes #22761 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22779) (cherry picked from commit 4169d58c855718d90424fd5da632cf2f2b46e691)
2024-04-02BIO_s_connect: Do not set keepalive on dgram socketsHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24015) (cherry picked from commit 56736800224eff5783e314fd334c047224081c58)
2024-04-02Document change of -verify behavior in crl and req appsVladimir Kotal
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23983) (cherry picked from commit 15585af97ec682182f40f815741e66f1ec40f941)
2024-04-02Remove handling of NULL sig param in ossl_ecdsa_deterministic_signBernd Edlinger
The handling of sig=NULL was broken in this function, but since it is only used internally and was never called with sig=NULL, it is better to return an error in that case. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23529) (cherry picked from commit 294782f3b5c4b81d682e6e8608bb6e851177494d)
2024-04-02Fix handling of NULL sig parameter in ECDSA_sign and similarBernd Edlinger
The problem is, that it almost works to pass sig=NULL to the ECDSA_sign, ECDSA_sign_ex and DSA_sign, to compute the necessary space for the resulting signature. But since the ECDSA signature is non-deterministic (except when ECDSA_sign_setup/ECDSA_sign_ex are used) the resulting length may be different when the API is called again. This can easily cause random memory corruption. Several internal APIs had the same issue, but since they are never called with sig=NULL, it is better to make them return an error in that case, instead of making the code more complex. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23529) (cherry picked from commit 1fa2bf9b1885d2e87524421fea5041d40149cffa)
2024-04-02Fix openssl req with -addext subjectAltName=dirNameBernd Edlinger
The syntax check of the -addext fails because the X509V3_CTX is used to lookup the referenced section, but the wrong configuration file is used, where only a default section with all passed in -addext lines is available. Thus it was not possible to use the subjectAltName=dirName:section as an -addext parameter. Probably other extensions as well. This change affects only the syntax check, the real extension was already created with correct parameters. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23669) (cherry picked from commit 387418893e45e588d1cbd4222549b5113437c9ab)
2024-04-02Bump actions/setup-python from 5.0.0 to 5.1.0dependabot[bot]
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.0.0 to 5.1.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5.0.0...v5.1.0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23977) (cherry picked from commit de85587911dcd41dc3546b348acf9c9f15dd7c3d)
2024-04-02Explicitly state what -keys doesSimo Sorce
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23919) (cherry picked from commit 693c479a2ca671e0dfca8d1ad14e789169b982ff)
2024-03-29Prepare for 3.3 beta 2Matt Caswell
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-29Prepare for release of 3.3 beta 1openssl-3.3.0-beta1Matt Caswell
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-29make updateMatt Caswell
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-29Copyright year updatesMatt Caswell
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-29Update CHANGES.md and NEWS.md with changes that have occurred since 3.2Matt Caswell
Release: yes Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23998)
2024-03-26Fix threadstest wrapping againNeil Horman
Stochastic failures in the RCU test on MACOSX are occuring. Due to beta release, disabling this test on MACOSX until post 3.3 release Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23967) (cherry picked from commit 1967539e212c17139dc810096da987c8100b1ba2)
2024-03-26Update gost-engine submodule to fix the CITomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23773) (cherry picked from commit e7d5d61b66ee5a1d0827b3c92dc4d484fb9c91fe)
2024-03-26apps/req,crl: exit with 1 on verification failureVladimir Kotal
Fixes #23771 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23773) (cherry picked from commit 6af739b79ba50bd42ac8934747ab5c8b996f16b6)
2024-03-25Add NULL check before accessing PKCS7 encrypted algorithmViliam Lejčík
Printing content of an invalid test certificate causes application crash, because of NULL dereference: user@user:~/openssl$ openssl pkcs12 -in test/recipes/80-test_pkcs12_data/bad2.p12 -passin pass: -info MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: Segmentation fault (core dumped) Added test cases for pkcs12 bad certificates Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23632) (cherry picked from commit a4cbffcd8998180b98bb9f7ce6065ed37d079d8b)
2024-03-25Replace size_t with int and add the check for the EVP_MD_get_size()Jiasheng Jiang
Replace the type of "digest_size" with int to avoid implicit conversion when it is assigned by EVP_MD_get_size(). Moreover, add the check for the "digest_size". Fixes: 29ce1066bc ("Update the demos/README file because it is really old. New demos should provide best practice for API use. Add demonstration for computing a SHA3-512 digest - digest/EVP_MD_demo") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23924) (cherry picked from commit 87e747000fef07c9ec43877bc5e9f2ca34f76a3b)
2024-03-25Replace unsigned with intJiasheng Jiang
Replace the type of "digest_length" with int to avoid implicit conversion when it is assigned by EVP_MD_get_size(). Otherwise, it may pass the following check and cause the integer overflow error when EVP_MD_get_size() returns negative numbers. Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23922) (cherry picked from commit f13ddaab69def0b453b75a8f2deb80e1f1634f42)
2024-03-25fix demos/sslecho/main.c so it builds on OpenBSD toosashan
trying to build `demos/sslecho/main.c` shipped by current openssl fails with error as follows: ``` cc -I../../include -g -Wall -c -o main.o main.c main.c:35:24: error: variable has incomplete type 'struct sockaddr_in' struct sockaddr_in addr; ^ main.c:35:12: note: forward declaration of 'struct sockaddr_in' struct sockaddr_in addr; ^ main.c:46:32: error: use of undeclared identifier 'INADDR_ANY' addr.sin_addr.s_addr = INADDR_ANY; ^ main.c:152:24: error: variable has incomplete type 'struct sockaddr_in' struct sockaddr_in addr; ^ main.c:152:12: note: forward declaration of 'struct sockaddr_in' struct sockaddr_in addr; ^ 3 errors generated. gmake: *** [<builtin>: main.o] Error 1 ``` including `netinet/in.h` fixes the build Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23936) (cherry picked from commit 01eaf203856bfbb63051f8ecf56eae2d21132496)
2024-03-23Correct OSSL_sleep for NonStop PUT model by introducing sleep().Randall S. Becker
This fix also removes SPT model support as it was previously deprecated. Upcoming threading models on the platform should be supportable without change to this method. Fixes: #23923 Fixes: #23927 Fixes: #23928 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23926) (cherry picked from commit 4a9e48f727ce7ad924c53a55b301e426d7e43863)
2024-03-22Don’t use the recvmmsg dgram method on Android <5Yavor Georgiev
recvmmsg and sendmmsg were only added to Android’s C library in version 5, starting with API Level 21. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23754) (cherry picked from commit 24109dca5a793d58c68a346db5b21746079ec317)
2024-03-22Fixed a typo and grammar in openssl-ts.podolszomal
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23913) (cherry picked from commit f1c14f1853d2df94e339208eed1df823c2238389)
2024-03-22fix uploading artifacts for paramertrized jobsDmitry Misharov
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23933) (cherry picked from commit 395ab201a7f99ebe2b1598890c9a43081867d226)
2024-03-22Make counters in rcu/rw threads torture test 64 bitNeil Horman
Its possible in some conditions for the rw/rcu torture tests to wrap the counter, leading to false positive failures, make them 64 bits to avoid this Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23724) (cherry picked from commit b50c174ee3b11f916285046d52574ba653745083)
2024-03-22Add M1 macOS runner to some workflowsDmitry Misharov
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23724) (cherry picked from commit ada9d8c785cce8e75a88675622dd5ec79e9aa6d7)
2024-03-22riscv: Fix remaining asm checksJakov Smolić
There are additional asm checks which don't check for OPENSSL_CPUID_OBJ causing the build to still fail on riscv [1], so fix them in the same manner as ff279597692f9f19dca5b147944d3d96f2e109f8 [1] https://bugs.gentoo.org/923956 Fixes: https://github.com/openssl/openssl/issues/22871 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23752)
2024-03-22Update FIPS hmac key documentationMatt Hauck
The documentation is slightly incorrect about the FIPS hmac key. CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23846) (cherry picked from commit 53ef123f48d402aff7c27f8ec15191cb1cde4105)
2024-03-21Move artifact upload code into the shell scriptHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23551) (cherry picked from commit 9abcf116962e9a117717c751de93846f11da16cd)
2024-03-21Experimental support for uploading qlog artifactsHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23551) (cherry picked from commit f2db70962cacc2602bc614d51e0610085c99e999)
2024-03-20Prepare for 3.3 alpha 2Richard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-20Prepare for release of 3.3 alpha 1openssl-3.3.0-alpha1Richard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-20make updateRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-20Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-15Fix unbounded memory growth when using no-cached-fetchMatt Caswell
When OpenSSL has been compiled with no-cached-fetch we do not cache algorithms fetched from a provider. When we export an EVP_PKEY to a provider we cache the details of that export in the operation cache for that EVP_PKEY. Amoung the details we cache is the EVP_KEYMGMT that we used for the export. When we come to reuse the key in the same provider that we have previously exported the key to, we check the operation cache for the cached key data. However because the EVP_KEYMGMT instance was not cached then instance will be different every time and we were not recognising that we had already exported the key to the provider. This causes us to re-export the key to the same provider everytime the key is used. Since this consumes memory we end up with unbounded memory growth. The fix is to be more intelligent about recognising that we have already exported key data to a given provider even if the EVP_KEYMGMT instance is different. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23841)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-11 16:47:35 +0000