shim: set GOST engine as default if selected#28
Merged
oleg-jukovec merged 2 commits intoJul 17, 2026
Conversation
Col-Waltz
force-pushed
the
Col-Waltz/add-gost-engine-init
branch
from
July 16, 2026 13:41
1ecb2b0 to
864656c
Compare
Col-Waltz
changed the title
Col-Waltz
force-pushed
the
Col-Waltz/add-gost-engine-init
branch
from
July 16, 2026 14:13
efe3bcd to
f4203be
Compare
oleg-jukovec
requested changes
Jul 16, 2026
oleg-jukovec
left a comment
oleg-jukovec
left a comment
Collaborator
There was a problem hiding this comment.
Thank you for the patch. See above.
Please, add a CHANGELOG.md entry too.
bigbes
requested changes
Jul 16, 2026
bigbes
left a comment
bigbes
left a comment
There was a problem hiding this comment.
Let's put test fixtures in its own subfolder: testdata/gost/ - it'll signalize that this files are test data.
Add openssl_gost tests that load a GOST private key/certificate from PEM using the public Go API.
Col-Waltz
force-pushed
the
Col-Waltz/add-gost-engine-init
branch
from
July 16, 2026 21:54
f4203be to
95e340d
Compare
bigbes
approved these changes
Jul 16, 2026
oleg-jukovec
requested changes
Jul 17, 2026
If GOST engine is selected in static build it should be initialized and set as default with flags to perform PKEY/ASN1 methods and PEM decoding for GOST private keys.
Col-Waltz
force-pushed
the
Col-Waltz/add-gost-engine-init
branch
from
July 17, 2026 07:11
95e340d to
6b5f158
Compare
oleg-jukovec
approved these changes
Jul 17, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the latest release optional static linking of the GOST engine was added.
However, when openssl_gost is enabled we only call ENGINE_load_gost() and verify that the engine is present, but we never initialize it nor set it as default.
As a result, OpenSSL continues to use the built-in default methods for PKEY/ASN.1 operations, which do not support GOST key/certificate formats. This breaks PEM key/certificate loading (and other operations that rely on PKEY/ASN.1 methods).
Example failure: https://github.com/tarantool/go-openssl/actions/runs/29503272983/job/87637409141
This change initializes the GOST engine and sets it as default for PKEY/ASN.1 methods when openssl_gost is enabled, restoring correct PEM encoding/decoding and related functionality.