fix: validate private key before export in get_private_key_string()#143
Merged
atoomic merged 1 commit intoApr 3, 2026
Merged
Conversation
Every other private-key operation (decrypt, sign, private_encrypt, check_key) validates _is_private() first. get_private_key_string() was the only one missing this check, leading to version-dependent behavior: silent garbage PEM on pre-3.x, cryptic OpenSSL error on 3.x. Now croaks with a clear message on all versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
timlegge
approved these changes
Apr 3, 2026
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add
_is_private()check toget_private_key_string()for consistent behavior across all OpenSSL versions.Why
Every private-key operation (
decrypt,sign,private_encrypt,check_key) validates the key is actually private before proceeding.get_private_key_string()was the only one missing this guard, causing version-dependent behavior when called on a public-only key:How
Single
_is_private()check added before the passphrase/cipher logic. Follows the exact same pattern used bydecrypt(),sign(), etc. Test updated frompass()(always succeeds) tolike()matching the new error message.Testing
Full test suite: 507 tests pass on OpenSSL 3.5.1. The specific test (
t/format.t) now verifies the croak message rather than just checking it doesn't crash.🤖 Generated with Claude Code