From 7c70c3d352f7e8f16ed799f03957ee87840da4e6 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@dtucker.net>
Date: Wed, 24 Jun 2026 19:22:36 +1000
Subject: [PATCH] Fix handling of rh-allow-sha1-signatures on Cygwin

The format of openssl.cnf has changed, so append to it instead of trying
to insert into it.  Test that openssl can sign RSA with SHA1 before
proceeding.
---
 .github/setup_ci.sh         | 23 +++++++++++++++++++++--
 .github/workflows/c-cpp.yml |  3 ++-
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh
index 63c61f9a0..99df2181e 100755
--- a/.github/setup_ci.sh
+++ b/.github/setup_ci.sh
@@ -27,10 +27,29 @@ case "$host" in
 	icacls regress /c /t /q /grant 'BUILTIN\Administrators:(RX)'
 	echo "Modifiled ACLs"
 	icacls regress
+
 	echo Enabling OpenSSL rh-allow-sha1-signatures for unit tests.
 	cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak
-	sed -i -e '/\[ default_modules \]/a alg_section = evp_properties\n[evp_properties]\nrh-allow-sha1-signatures = yes\n' /etc/pki/tls/openssl.cnf
-	diff -u /etc/pki/tls/openssl.cnf.bak /etc/pki/tls/openssl.cnf
+	cat >>/etc/pki/tls/openssl.cnf <<EOD
+[openssl_init]
+alg_section = evp_properties
+
+[evp_properties]
+rh-allow-sha1-signatures = yes
+EOD
+	openssl list -providers -provider legacy
+	printf "Test openssl signing with RSA+SHA1: "
+	openssl genpkey -quiet -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
+	openssl pkey -in private_key.pem -pubout -out public_key.pem
+	if ! openssl dgst -sha1 -sign private_key.pem -out signature.sig public_key.pem; then
+		echo fail
+		echo "openssl could not sign with RSA+SHA1."
+		cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak regress/
+		exit 1
+	else
+		echo success
+	fi
+
 	PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core"
 	PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel"
 	;;
diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index dde7665b6..ffead602f 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -136,7 +136,8 @@ jobs:
       id: cygwin_install
       if: ${{ startsWith(matrix.target, 'windows') }}
       uses: cygwin/cygwin-install-action@a3d72946b163026bbd0fa9a88379ccbda4bd86bb # master
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
+    - name: checkout openssh git repo
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
     - name: setup CI system
       run: |
         sh -c "timeout 1200 .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }} || .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}"