openssl: toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache

[bagder]

Reported-by: Stanislav Fort

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: OpenSSL: include CURLSSLOPT_NO_PARTIALCHAIN in the X509 store cache key so a CA store built with different partial-chain behavior is not reused.
Change: Persist and compare no_partialchain in ossl_x509_share when deciding whether a cached X509_STORE matches the current SSL config.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

[Copilot]

Pull request overview

This PR fixes a bug where toggling the CURLSSLOPT_NO_PARTIALCHAIN option would incorrectly reuse a cached X509_STORE that was created with a different setting for this option. The no_partialchain flag controls whether OpenSSL's X509_V_FLAG_PARTIAL_CHAIN is set on the certificate store, which affects certificate chain validation behavior.

Key Changes:

• Added no_partialchain field to ossl_x509_share structure to track the partial chain state of cached stores
• Modified ossl_cached_x509_store_different() to check if the cached store's no_partialchain setting matches the current request
• Updated ossl_set_cached_x509_store() to save the no_partialchain state when caching a store

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.