On the port, these checks are disabled by default
On 9/30/26 11:49, Stuart Henderson wrote:
moved to ports@; [email protected] is a dead mailing list
doesn't nextcloud have integrity checks that get in the way of patching?
On 2026/09/30 11:42, Fedor wrote:
By default, nextcloud sends the wrong signature type to openss_sign. Instead
of OPENSSL_ALGO_*, it gets 'rsa-*', which causes an error when trying to
grant access to the file to a user from another server. The patches below
fix this problem.
--- server-34.0.4/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
Thu Sep 10 16:04:04 2026
+++
/var/www/nextcloud/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
Fri Sep 25 00:29:00 2026
@@ -16,9 +16,9 @@
* @since 33.0.0
*/
#[Consumable(since: '33.0.0')]
-enum SignatureAlgorithm: string {
+enum SignatureAlgorithm: int {
/** @since 33.0.0 */
- case RSA_SHA256 = 'rsa-sha256';
+ case RSA_SHA256 = OPENSSL_ALGO_SHA256;
/** @since 33.0.0 */
- case RSA_SHA512 = 'rsa-sha512';
+ case RSA_SHA512 = OPENSSL_ALGO_SHA512;
}
enum fix in /lib/public/Security/Signature/Enum/SignatureAlgorithm.php
---
server-34.0.4/lib/private/Security/Signature/Model/IncomingSignedRequest.php
Thu Sep 10 16:04:04 2026
+++
/var/www/nextcloud/lib/private/Security/Signature/Model/IncomingSignedRequest.php
Sat Sep 26 12:58:08 2026
@@ -249,7 +249,7 @@
throw new SignatoryNotFoundException('empty public
key');
}
- $algorithm =
SignatureAlgorithm::tryFrom($this->getSigningElement('algorithm')) ??
SignatureAlgorithm::RSA_SHA256;
+ $algorithm = SignatureAlgorithm::tryFrom((int)
$this->getSigningElement('algorithm')) ?? SignatureAlgorithm::RSA_SHA256;
if (openssl_verify(
implode("\n", $this->getSignatureData()),
base64_decode($this->getSignature()),
I don't know why, but $this->getSigningElement('algorithm') returns
OPENSSL_ALGO_SHA256 in string format.
These fixes definitely work on version 34. NextCloud has been running
smoothly for a week now
