From: Stuart Henderson <stu@spacehopper.org>
Subject: Re: [BUG-FIX] www/nextcloud 34
To: Fedor <fedorgorlenko@gmail.com>
Cc: ports-bugs@openbsd.org, ports@openbsd.org
Date: Wed, 30 Sep 2026 10:38:27 +0100

On 2026/09/30 09:49, Stuart Henderson wrote:
> moved to ports@; ports-bugs@openbsd.org is a dead mailing list
> 
> doesn't nextcloud have integrity checks that get in the way of patching?

I had an off-list reply (please, keep it on ports@):

"On the port, these checks are disabled by default"


> On 2026/09/30 11:42, Fedor wrote:
> > By default, nextcloud sends the wrong signature type to openss_sign. Instead
> > of OPENSSL_ALGO_*, it gets 'rsa-*', which causes an error when trying to
> > grant access to the file to a user from another server. The patches below
> > fix this problem.
> > 
> > 
> > --- server-34.0.4/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
> >    Thu Sep 10 16:04:04 2026
> > +++
> > /var/www/nextcloud/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
> >       Fri Sep 25 00:29:00 2026
> > @@ -16,9 +16,9 @@
> >   * @since 33.0.0
> >   */
> >  #[Consumable(since: '33.0.0')]
> > -enum SignatureAlgorithm: string {
> > +enum SignatureAlgorithm: int {
> >         /** @since 33.0.0 */
> > -       case RSA_SHA256 = 'rsa-sha256';
> > +       case RSA_SHA256 = OPENSSL_ALGO_SHA256;
> >         /** @since 33.0.0 */
> > -       case RSA_SHA512 = 'rsa-sha512';
> > +       case RSA_SHA512 = OPENSSL_ALGO_SHA512;
> >  }
> > 
> > 
> > enum fix in /lib/public/Security/Signature/Enum/SignatureAlgorithm.php
> > 
> > 
> > ---
> > server-34.0.4/lib/private/Security/Signature/Model/IncomingSignedRequest.php
> >       Thu Sep 10 16:04:04 2026
> > +++ /var/www/nextcloud/lib/private/Security/Signature/Model/IncomingSignedRequest.php
> >  Sat Sep 26 12:58:08 2026
> > @@ -249,7 +249,7 @@
> >                         throw new SignatoryNotFoundException('empty public
> > key');
> >                 }
> > 
> > -               $algorithm =
> > SignatureAlgorithm::tryFrom($this->getSigningElement('algorithm')) ??
> > SignatureAlgorithm::RSA_SHA256;
> > +               $algorithm = SignatureAlgorithm::tryFrom((int)
> > $this->getSigningElement('algorithm')) ?? SignatureAlgorithm::RSA_SHA256;
> >                 if (openssl_verify(
> >                         implode("\n", $this->getSignatureData()),
> >                         base64_decode($this->getSignature()),
> > 
> > I don't know why, but $this->getSigningElement('algorithm') returns
> > OPENSSL_ALGO_SHA256 in string format.
> > 
> > These fixes definitely work on version 34. NextCloud has been running
> > smoothly for a week now
> > 
> > 
>