Improve credential loading diagnostics, function parameter declarations, etc.

[DDvO]

• credential_loading.{c,h}: generalize cert and CRL loading to support HTTP download of PEM/DER encoded data

• credential_loading.c: fix FILES_load_credentials_ex() double free, diagnostics, and indentation

• credential_loading.c: move definition of FILES_load_credentials_ex() and CREDENTIALS_load_ex() for consistency with header file

• credential_loading.{c,h}: rename 'src' parameter of FILES_load_crl_ex() to 'uri'

• credential_loading.{c,h}: add missing OPTIONAL and remove needless 'maybe_stdin' parameter of FILES_load_certs_ex()

• credential_loading.c: improve diagnostics of FILES_load_*_ex() and STORE_load_more_check_ex()

• credential_loading.{c,h}: consistently use 'file_format_t format' and 'bool maybe_stdin'

• 80-test_cmp_http.t: align with latest upstream OpenSSL version of that script, , fixing CI hangs for OpenSSL 3.6+ (this commit is also part of add support for ML-DSA-* etc., various small fixes; OpenSSL 4.0 compat #119, repeated here to avoid needless CI failures)

• credential_loading.{c,h}: rename FILES_* to CREDS_*

• credential_loading.{c,h}: move most contents to creds.{c,h} for preparing their potential move to libSecUtils

• credential_loading.c: tweak diagnostics of load_key_certs_crls(), CREDS_load_cert_ex(), and CREDS_load_crl_ex()

• demo.cnf,Makefile_v1: add some options to avoid warnings

• credential_loading.{c,h},cmpClient.c: simplify naming of most loading functions

• move credential_loading.{c,h} into genCMPClient library

• genericCMPClient_util.{v,h}: compensate for stuff needed by new credential loading in case GENCMP_NO_SECUTILS

• credential_loading.{c,h},cmpClient.c: streamline credentials loading API, generalize HTTP(S) support

• credential_loading.c: increase max_resp_len used by http_get_mem() calling OSSL_HTTP_get()

• genericCMPClient_util.{v,h}: fix Windows compatibility

[Copilot]

Pull request overview

This PR updates credential/certificate/CRL loading to better support HTTP-sourced data and improves diagnostics/consistency across the credential-loading APIs, while also syncing the CMP HTTP test recipe with a newer upstream OpenSSL variant.

Changes:

• Extend cert/CRL loading logic to download and decode PEM/DER over HTTP (with updated logging and parameter conventions).
• Refactor/align credential-loading function signatures (OPTIONAL annotations, parameter naming, timeout plumbing).
• Update 80-test_cmp_http.t and test config to match newer upstream behavior (skip conditions, server host/port derivation, improved failure logs).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
test/recipes/80-test_cmp_http.t	Updates CMP HTTP test harness logic (skip gates, server discovery, enhanced failure logging).
test/recipes/80-test_cmp_http_data/test.cnf	Adjusts port config to reference $server_port for dynamic substitution.
src/credential_loading.h	Updates/aligns credential-loading API declarations (OPTIONAL, formats, parameter naming).
src/credential_loading.c	Implements HTTP download+decode helpers and refactors credential/cert/CRL loading and diagnostics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/credential_loading.c:908

• FILES_load_crl_ex() leaks the memory BIO returned by http_get_mem(): mem is not freed after PEM_read_bio_X509_CRL()/d2i_X509_CRL_bio(). Mirror the certificate-loading path and BIO_free(mem) in all cases (including decode failure).

        BIO *mem = http_get_mem(uri, timeout, "-----BEGIN X509 CRL-----", &is_pem, desc);
        if (mem != NULL) {
            crl = is_pem ? PEM_read_bio_X509_CRL(mem, NULL, NULL, NULL) : d2i_X509_CRL_bio(mem, NULL);
            if (crl == NULL)
                LOG(FL_ERR, "Unable to decode %s from %s", desc, uri);
        }

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/credential_loading.c:916

• FILES_load_crl_ex() uses CONN_IS_HTTP(uri) / CONN_IS_HTTPS(uri) and calls CRL_check(uri, ...), but uri is an OPTIONAL parameter and may be NULL when reading from stdin. This can lead to crashes/undefined behavior (e.g., %s formatting with a NULL src). Add uri != NULL guards for scheme checks and pass a non-NULL placeholder like "<stdin>" into CRL_check() / error messages when uri is NULL.

    LOG(FL_DEBUG, "Loading %s from %s", desc, uri != NULL ? uri : "<stdin>");
    if (CONN_IS_HTTP(uri) || CONN_IS_HTTPS(uri)) {
        bool is_pem;
        BIO *mem = http_get_mem(uri, timeout, "-----BEGIN X509 CRL-----", &is_pem, desc);
        if (mem != NULL) {
            crl = is_pem ? PEM_read_bio_X509_CRL(mem, NULL, NULL, NULL) : d2i_X509_CRL_bio(mem, NULL);
            BIO_free(mem);
            if (crl == NULL)
                LOG(FL_ERR, "Unable to decode %s from %s", desc, uri);
        }
    } else {
        (void)load_key_certs_crls(libctx, propq,
                                  uri, format, maybe_stdin, NULL, desc, false,
                                  NULL, NULL,  NULL, NULL, NULL, 0, &crl, NULL, 1);
    }
    if (!CRL_check(uri, crl, vpm) && vpm != NULL) {
        X509_CRL_free(crl);
        crl = NULL;

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
61.5% Coverage on New Code (required ≥ 80%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

[sonarqubecloud]

Quality Gate failed

Failed conditions
52.3% Coverage on New Code (required ≥ 80%)
8.8% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud