)]}'
{"id":"openvpn~2152","triplet_id":"openvpn~master~Ibc9eb15714f14a9f49366fc84072087fc3f013c9","project":"openvpn","branch":"master","full_branch":"refs/heads/master","attention_set":{},"removed_from_attention_set":{"1000030":{"account":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"last_update":"2026-11-13 09:55:18.000000000","reason":"Change was submitted"},"1000053":{"account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"last_update":"2026-11-13 09:55:18.000000000","reason":"Change was submitted"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-11-13 09:55:18.000000000","reason":"Change was submitted"},"1000035":{"account":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"last_update":"2026-11-10 14:24:51.000000000","reason":"\u003cGERRIT_ACCOUNT_1000035\u003e replied on the change","reason_account":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."}}},"hashtags":[],"change_id":"Ibc9eb15714f14a9f49366fc84072087fc3f013c9","subject":"ssl_verify: reject an empty certificate fingerprint","status":"MERGED","created":"2026-11-07 16:05:06.000000000","updated":"2026-11-13 09:55:18.000000000","submitted":"2026-11-13 09:55:18.000000000","submitter":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"2152","meta_rev_id":"1bc597608ae7f78b72c0e231ec6297bbb4909f8a","_number":2152,"virtual_id_number":2152,"owner":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},{"value":0,"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."}],"CC":[{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-11-07 16:05:07.000000000","updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"real_updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-11-07 16:05:07.000000000","updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"real_updated_by":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-11-09 12:28:01.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"CC"},{"updated":"2026-11-09 12:28:01.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"state":"REVIEWER"},{"updated":"2026-11-09 12:28:10.000000000","updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"real_updated_by":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"state":"REVIEWER"}],"messages":[{"id":"79d77f0a14aeee533a7f1b47537880a627d31a37","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-11-07 16:05:06.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"adf40645ffcc69d38687958a07b6577ed3ae2ce4","author":{"_account_id":1000035,"name":"Steffan Karger","display_name":"Steffan Karger","email":"steffan@karger.me","username":"syzzer","status":"Commits and comments are my own views, not those of my employer."},"date":"2026-11-10 14:24:51.000000000","message":"Patch Set 1: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"1bc597608ae7f78b72c0e231ec6297bbb4909f8a","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-11-13 09:55:18.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"11da41d10b9a772df0dec1862e25f3e303a56ce0","revisions":{"a4735b9d6380f5a30ddd7174ae78dc86ef90e1de":{"kind":"REWORK","_number":1,"created":"2026-11-07 16:05:06.000000000","uploader":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"ref":"refs/changes/52/2152/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/52/2152/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/1 \u0026\u0026 git checkout -b change-2152 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/52/2152/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"5b08a76c1a3215c9c927909e695ccd8e83eb6895","subject":"Make parameter openvpn_net_ctx_t const where possible"}],"author":{"name":"Razvan Cojocaru","email":"razvanc@mailbox.org","date":"2026-11-07 15:37:51.000000000","tz":120},"committer":{"name":"Razvan Cojocaru","email":"razvanc@mailbox.org","date":"2026-11-07 15:40:19.000000000","tz":120},"subject":"ssl_verify: reject an empty certificate fingerprint","message":"ssl_verify: reject an empty certificate fingerprint\n\nverify_cert() compares the configured hashes over the length of the\ncomputed fingerprint. With mbedTLS built without SHA-1 the SHA-1\nfingerprint is empty, so the zero-length compare matched the first\nentry and --verify-hash \u003chash\u003e SHA1 accepted any CA certificate at\ndepth 1. Reject an empty fingerprint instead.\n\nThe compare length has come from the computed fingerprint since\n2193d7c0 (\"crypto: Enable SHA256 fingerprint checking in --verify-hash\").\n\nChange-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9\nSigned-off-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\n"},"branch":"refs/heads/master"},"11da41d10b9a772df0dec1862e25f3e303a56ce0":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":2,"created":"2026-11-13 09:55:18.000000000","uploader":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/52/2152/2","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/52/2152/2","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/2 \u0026\u0026 git checkout -b change-2152 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/52/2152/2","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/52/2152/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"95e4fd0f905fea3decfdbdd28caeee901009d250","subject":"tls: reject incoming reneg request if primary key is not fully valid"}],"author":{"name":"Razvan Cojocaru","email":"razvanc@mailbox.org","date":"2026-11-10 14:36:56.000000000","tz":60},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-11-13 09:22:22.000000000","tz":60},"subject":"ssl_verify: reject an empty certificate fingerprint","message":"ssl_verify: reject an empty certificate fingerprint\n\nverify_cert() compares the configured hashes over the length of the\ncomputed fingerprint. With mbedTLS built without SHA-1 the SHA-1\nfingerprint is empty, so the zero-length compare matched the first\nentry and --verify-hash \u003chash\u003e SHA1 accepted any CA certificate at\ndepth 1. Reject an empty fingerprint instead.\n\nThe compare length has come from the computed fingerprint since\n2193d7c0 (\"crypto: Enable SHA256 fingerprint checking in --verify-hash\").\n\nChange-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9\nSigned-off-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nAcked-by: Steffan Karger \u003csteffan@karger.me\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152\nMessage-Id: \u003c20261110143703.15137-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg41110.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[]}