From: Fedor <fedorgorlenko@gmail.com>
Subject: Re: [BUG-FIX] www/nextcloud 34
To: ports@openbsd.org
Date: Wed, 30 Sep 2026 12:37:55 +0300

On the port, these checks are disabled by default

On 9/30/26 11:49, Stuart Henderson wrote:
> moved to ports@; ports-bugs@openbsd.org is a dead mailing list
>
> doesn't nextcloud have integrity checks that get in the way of patching?
>
> On 2026/09/30 11:42, Fedor wrote:
>> By default, nextcloud sends the wrong signature type to openss_sign. Instead
>> of OPENSSL_ALGO_*, it gets 'rsa-*', which causes an error when trying to
>> grant access to the file to a user from another server. The patches below
>> fix this problem.
>>
>>
>> --- server-34.0.4/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
>>     Thu Sep 10 16:04:04 2026
>> +++
>> /var/www/nextcloud/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
>>        Fri Sep 25 00:29:00 2026
>> @@ -16,9 +16,9 @@
>>    * @since 33.0.0
>>    */
>>   #[Consumable(since: '33.0.0')]
>> -enum SignatureAlgorithm: string {
>> +enum SignatureAlgorithm: int {
>>          /** @since 33.0.0 */
>> -       case RSA_SHA256 = 'rsa-sha256';
>> +       case RSA_SHA256 = OPENSSL_ALGO_SHA256;
>>          /** @since 33.0.0 */
>> -       case RSA_SHA512 = 'rsa-sha512';
>> +       case RSA_SHA512 = OPENSSL_ALGO_SHA512;
>>   }
>>
>>
>> enum fix in /lib/public/Security/Signature/Enum/SignatureAlgorithm.php
>>
>>
>> ---
>> server-34.0.4/lib/private/Security/Signature/Model/IncomingSignedRequest.php
>>        Thu Sep 10 16:04:04 2026
>> +++ /var/www/nextcloud/lib/private/Security/Signature/Model/IncomingSignedRequest.php
>>   Sat Sep 26 12:58:08 2026
>> @@ -249,7 +249,7 @@
>>                          throw new SignatoryNotFoundException('empty public
>> key');
>>                  }
>>
>> -               $algorithm =
>> SignatureAlgorithm::tryFrom($this->getSigningElement('algorithm')) ??
>> SignatureAlgorithm::RSA_SHA256;
>> +               $algorithm = SignatureAlgorithm::tryFrom((int)
>> $this->getSigningElement('algorithm')) ?? SignatureAlgorithm::RSA_SHA256;
>>                  if (openssl_verify(
>>                          implode("\n", $this->getSignatureData()),
>>                          base64_decode($this->getSignature()),
>>
>> I don't know why, but $this->getSigningElement('algorithm') returns
>> OPENSSL_ALGO_SHA256 in string format.
>>
>> These fixes definitely work on version 34. NextCloud has been running
>> smoothly for a week now
>>
>>