Testfreebsd13 /muthuja

Gemfile

@@ -17,6 +17,11 @@ end
 
 gem "cheffish", "~> 17.0.0"
 
+# This is to help patch in openssl for Ruby 3.0.x, since Ruby 3.0 uses OpenSSL <3.0
+# unless you build without and reintroduce it manually.
+# Remove once we're no longer supporting Ruby 3.0.x.
+gem "openssl", "= 3.0.0"
+
 gem "ast", "~> 2.4.2"
 gem "rubocop-ast", ">= 1.31.0"
 

Gemfile.lock

@@ -285,6 +285,7 @@ GEM
       net-ssh (>= 5.0.0, < 8.0.0)
     net-ssh (7.2.1)
     nori (2.6.0)
+    openssl (3.0.0)
     parallel (1.23.0)
     parser (3.3.0.5)
       ast (~> 2.4.1)
@@ -455,6 +456,7 @@ DEPENDENCIES
   fauxhai-ng
   inspec-core-bin (~> 5.22.40)
   ohai!
+  openssl (= 3.0.0)
   pry (>= 0.14.1)
   pry-byebug
   pry-stack_explorer

lib/chef/mixin/openssl_helper.rb

@@ -157,7 +157,7 @@ def gen_ec_priv_key(curve)
         raise TypeError, "curve must be a string" unless curve.is_a?(String)
         raise ArgumentError, "Specified curve is not available on this system" unless %w{prime256v1 secp384r1 secp521r1}.include?(curve)
 
-        ::OpenSSL::PKey::EC.new(curve).generate_key
+        ::OpenSSL::PKey::EC.generate(curve)
       end
 
       # generate pem format of the public key given a private key

omnibus_overrides.rb

@@ -13,9 +13,13 @@
 override "makedepend", version: "1.0.5"
 override "ncurses", version: "6.3"
 override "nokogiri", version: "1.13.1"
-override "openssl", version: mac_os_x? ? "1.1.1m" : "1.0.2zi"
+override "openssl", version: "3.0.9"
 override "pkg-config-lite", version: "0.28-1"
-override "ruby", version: "3.0.3"
+if freebsd?
+  override "ruby", version: "3.1.2", openssl_gem: "3.0.0"
+else
+  override "ruby", version: "3.0.3", openssl_gem: "3.0.0"
+end
 override "ruby-windows-devkit-bash", version: "3.1.23-4-msys-1.0.18"
 override "util-macros", version: "1.19.0"
 override "xproto", version: "7.0.28"

spec/unit/mixin/openssl_helper_spec.rb

@@ -92,12 +92,15 @@
 
     context "When the dhparam.pem file does exist, and does contain a vaild dhparam key" do
       it "returns true" do
-        @dhparam_file.puts(::OpenSSL::PKey::DH.new(256).to_pem) # this is 256 to speed up specs
+        @dhparam_file.puts(::OpenSSL::PKey::DH.new(1024).to_pem)
         @dhparam_file.close
         expect(instance.dhparam_pem_valid?(@dhparam_file.path)).to be_truthy
       end
     end
 
+    it "rejects a modulus < 1024" do
+      expect { ::OpenSSL::PKey::DH.new(256).to_pem }.to raise_error(OpenSSL::PKey::PKeyError)
+    end
     after(:each) do
       @dhparam_file.unlink
     end