From: Fedor <fedorgorlenko@gmail.com>
Subject: [BUG-FIX] www/nextcloud 34
To: ports@openbsd.org
Date: Wed, 30 Sep 2026 11:47:13 +0300

By default, nextcloud sends the wrong signature type to openss_sign. 
Instead of OPENSSL_ALGO_*, it gets 'rsa-*', which causes an error when 
trying to grant access to the file to a user from another server. The 
patches below fix this problem.


--- 
server-34.0.4/lib/public/Security/Signature/Enum/SignatureAlgorithm.php 
    Thu Sep 10 16:04:04 2026
+++ 
/var/www/nextcloud/lib/public/Security/Signature/Enum/SignatureAlgorithm.php 
       Fri Sep 25 00:29:00 2026
@@ -16,9 +16,9 @@
   * @since 33.0.0
   */
  #[Consumable(since: '33.0.0')]
-enum SignatureAlgorithm: string {
+enum SignatureAlgorithm: int {
         /** @since 33.0.0 */
-       case RSA_SHA256 = 'rsa-sha256';
+       case RSA_SHA256 = OPENSSL_ALGO_SHA256;
         /** @since 33.0.0 */
-       case RSA_SHA512 = 'rsa-sha512';
+       case RSA_SHA512 = OPENSSL_ALGO_SHA512;
  }


enum fix in /lib/public/Security/Signature/Enum/SignatureAlgorithm.php


--- 
server-34.0.4/lib/private/Security/Signature/Model/IncomingSignedRequest.php 
       Thu Sep 10 16:04:04 2026
+++ 
/var/www/nextcloud/lib/private/Security/Signature/Model/IncomingSignedRequest.php 
  Sat Sep 26 12:58:08 2026
@@ -249,7 +249,7 @@
                         throw new SignatoryNotFoundException('empty 
public key');
                 }

-               $algorithm = 
SignatureAlgorithm::tryFrom($this->getSigningElement('algorithm')) ?? 
SignatureAlgorithm::RSA_SHA256;
+               $algorithm = SignatureAlgorithm::tryFrom((int) 
$this->getSigningElement('algorithm')) ?? SignatureAlgorithm::RSA_SHA256;
                 if (openssl_verify(
                         implode("\n", $this->getSignatureData()),
                         base64_decode($this->getSignature()),

I don't know why, but $this->getSigningElement('algorithm') returns 
OPENSSL_ALGO_SHA256 in string format.

These fixes definitely work on version 34. NextCloud has been running 
smoothly for a week now