applied-series: [PATCH common/proxmox-acme v4 0/3] fix #5978: pem parser: relax parsing of chain entries

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

with a tiny test follow-up in common

On August 5, 2026 4:11 pm, Thomas Ellmenreich wrote:
> According to RFC 8555, expected certchains should come
> without whitespace or explanatory texts inbetween chain
> entries. These two patches relax our parser to also
> accept text or whitespaces inbetween chain entries.
> 
> To make sure that the acme changes work as expected I
> setup the pebble acme server [1] locally, and worked
> through the acme flow to get a new certificate. I then
> manually modified the final certificate to contain
> descriptive text which worked without issues.
> 
> changes since v3:
> - check_pem was reworked to not be recursive
> 
> - the check_pem tests now also check the erroring version to
>   make sure that an exception is thrown
> 
> - moved the tests to their own commit
> 
> - wrapped the error message produced by check_pem when
>   called in proxmox-acme with chomp to avoid double newlines
> 
> - corrected the capitalization of different acronyms
> 
> changes since v2:
> - cleaner implementation and correction of mistakes in
>   check_pem in pve-common
> 
> - get_certificate in proxmox-acme now correctly calls
>   check_pem with the 'multiple' option enabled
> 
> - removed ambiguity in the error messages of
>   get_certificate
> 
> - correction of tests, to better compare returned value
>   to expected value
> 
> - performed proper end-to-end test with pebble [1]
> 
> - proper formatting (hopefully)
> 
> changes since v1:
> - Where in v1 check_pem was just a wrapper of split_pem,
>   they now perform different functions
> 
> - split_pem now purely splits the PEM chain into separate
>   entries and does no further validation. Returning each
>   entry with its leading text.
> 
> - check_pem retains the original functionality, except
>   when the multiple option is active, in which case it
>   uses split_pem to get single entries and then calls
>   itself recursively
> 
> - On the ACME side, errors are now captured, wrapped,
>   and then rethrown.
> 
> [1] https://github.com/letsencrypt/pebble
> 
> 
> pve-common:
> 
> Thomas Ellmenreich (2):
>   fix #5978: pem parser: relax parsing of chain entries
>   pem parser: add testsuite for check_ and split_pem
> 
>  src/PVE/Certificate.pm |  39 ++++-
>  test/Makefile          |   2 +
>  test/check_pem_test.pl | 365 +++++++++++++++++++++++++++++++++++++++++
>  test/split_pem_test.pl | 279 +++++++++++++++++++++++++++++++
>  4 files changed, 677 insertions(+), 8 deletions(-)
>  create mode 100755 test/check_pem_test.pl
>  create mode 100755 test/split_pem_test.pl
> 
> 
> proxmox-acme:
> 
> Thomas Ellmenreich (1):
>   fix #5978: pem parser: relax parsing of chain entries:
> 
>  src/PVE/ACME.pm | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> 
> Summary over all repositories:
>   5 files changed, 684 insertions(+), 13 deletions(-)
> 
> -- 
> Generated by murpp 0.12.0
> 
> 
> 
> 
>