From 8adb1b7543d8c10602343a7bae3beac34d04bf21 Mon Sep 17 00:00:00 2001 From: Oz Date: Thu, 6 Aug 2026 01:51:21 +0000 Subject: [PATCH 1/2] Add openssl top-level completion spec (subcommands + global flags) Add command-signatures/json/openssl.json defining the top-level openssl command: all 53 standard subcommands (each with a short description) plus the global -help flag. Per-subcommand option trees are out of scope (tracked as separate child issues). Add a regression test asserting the signature exists with its subcommand list and top-level flag. Resolves APP-3963. Co-Authored-By: Warp Agent --- command-signatures/json/openssl.json | 224 +++++++++++++++++++++++++++ command-signatures/src/lib.rs | 37 +++++ 2 files changed, 261 insertions(+) create mode 100644 command-signatures/json/openssl.json diff --git a/command-signatures/json/openssl.json b/command-signatures/json/openssl.json new file mode 100644 index 00000000..d6fb2ac5 --- /dev/null +++ b/command-signatures/json/openssl.json @@ -0,0 +1,224 @@ +{ + "name": "openssl", + "description": "OpenSSL cryptography and SSL/TLS toolkit", + "options": [ + { + "name": "-help", + "description": "Display a summary of standard commands and options" + } + ], + "subcommands": [ + { + "name": "asn1parse", + "description": "Parse an ASN.1 sequence" + }, + { + "name": "ca", + "description": "Certificate authority management" + }, + { + "name": "ciphers", + "description": "Display or check SSL/TLS cipher suites" + }, + { + "name": "cmp", + "description": "Certificate Management Protocol (CMP, RFC 4210) client" + }, + { + "name": "cms", + "description": "Cryptographic Message Syntax (CMS) utility" + }, + { + "name": "crl", + "description": "Certificate revocation list (CRL) management" + }, + { + "name": "crl2pkcs7", + "description": "Create a PKCS#7 structure from a CRL and certificates" + }, + { + "name": "dgst", + "description": "Message digest calculation and signing" + }, + { + "name": "dhparam", + "description": "DH parameter manipulation and generation" + }, + { + "name": "dsa", + "description": "DSA key processing" + }, + { + "name": "dsaparam", + "description": "DSA parameter manipulation and generation" + }, + { + "name": "ec", + "description": "EC key processing" + }, + { + "name": "ecparam", + "description": "EC parameter manipulation and generation" + }, + { + "name": "enc", + "description": "Symmetric cipher encryption and decryption" + }, + { + "name": "engine", + "description": "Engine (loadable module) information and manipulation" + }, + { + "name": "errstr", + "description": "Look up OpenSSL error codes" + }, + { + "name": "fipsinstall", + "description": "Perform FIPS module installation and configuration" + }, + { + "name": "gendsa", + "description": "Generate a DSA key from a set of parameters" + }, + { + "name": "genpkey", + "description": "Generate a private key" + }, + { + "name": "genrsa", + "description": "Generate an RSA private key" + }, + { + "name": "help", + "description": "Display a list of commands or help for a command" + }, + { + "name": "info", + "description": "Print OpenSSL built-in information" + }, + { + "name": "kdf", + "description": "Perform key derivation function (KDF) operations" + }, + { + "name": "list", + "description": "List algorithms, commands, and capabilities" + }, + { + "name": "mac", + "description": "Perform message authentication code (MAC) operations" + }, + { + "name": "nseq", + "description": "Create or examine a Netscape certificate sequence" + }, + { + "name": "ocsp", + "description": "Online Certificate Status Protocol (OCSP) utility" + }, + { + "name": "passwd", + "description": "Compute password hashes" + }, + { + "name": "pkcs12", + "description": "PKCS#12 file management" + }, + { + "name": "pkcs7", + "description": "PKCS#7 data management" + }, + { + "name": "pkcs8", + "description": "PKCS#8 format private key conversion" + }, + { + "name": "pkey", + "description": "Public or private key management" + }, + { + "name": "pkeyparam", + "description": "Public key algorithm parameter processing" + }, + { + "name": "pkeyutl", + "description": "Public key algorithm cryptographic operation" + }, + { + "name": "prime", + "description": "Compute prime numbers" + }, + { + "name": "rand", + "description": "Generate pseudo-random bytes" + }, + { + "name": "rehash", + "description": "Create symbolic links to certificate and CRL files named by their hash values" + }, + { + "name": "req", + "description": "PKCS#10 certificate request and certificate generation" + }, + { + "name": "rsa", + "description": "RSA key processing" + }, + { + "name": "rsautl", + "description": "RSA utility for signing, verification, encryption, and decryption (deprecated; use pkeyutl)" + }, + { + "name": "s_client", + "description": "SSL/TLS client program for testing and debugging" + }, + { + "name": "s_server", + "description": "SSL/TLS server program for testing and debugging" + }, + { + "name": "s_time", + "description": "SSL/TLS performance timing program" + }, + { + "name": "sess_id", + "description": "SSL/TLS session handling" + }, + { + "name": "smime", + "description": "S/MIME message processing" + }, + { + "name": "speed", + "description": "Algorithm speed measurement" + }, + { + "name": "spkac", + "description": "Netscape SPKAC (signed public key and challenge) utility" + }, + { + "name": "srp", + "description": "Maintain an SRP password file" + }, + { + "name": "storeutl", + "description": "List and display objects in a URI store (certificates, keys, CRLs)" + }, + { + "name": "ts", + "description": "Time Stamping Authority (TSA) client and server tool" + }, + { + "name": "verify", + "description": "Certificate verification" + }, + { + "name": "version", + "description": "Print OpenSSL version information" + }, + { + "name": "x509", + "description": "X.509 certificate handling" + } + ] +} diff --git a/command-signatures/src/lib.rs b/command-signatures/src/lib.rs index b0a74f1d..3e01c32f 100644 --- a/command-signatures/src/lib.rs +++ b/command-signatures/src/lib.rs @@ -157,6 +157,43 @@ mod tests { } } + /// Regression test for the top-level `openssl` signature (APP-3963): it must + /// expose its subcommand list (each with a description) and the global + /// `-help` flag, so `openssl ` surfaces subcommands and top-level flags. + #[test] + fn openssl_signature_has_top_level_subcommands_and_flags() { + let signature = + signature_by_name("openssl").expect("openssl signature should exist and deserialize"); + + let subcommand_names: HashSet<&str> = + signature.subcommands().iter().map(|s| s.name()).collect(); + for expected in [ + "req", "x509", "genrsa", "genpkey", "s_client", "s_server", "enc", "dgst", "verify", + "ca", "pkcs12", "rsa", "ec", "ecparam", "pkey", "list", "version", + ] { + assert!( + subcommand_names.contains(expected), + "openssl signature is missing the `{expected}` subcommand" + ); + } + + for subcommand in signature.subcommands() { + assert!( + subcommand + .description + .as_deref() + .is_some_and(|d| !d.is_empty()), + "openssl subcommand `{}` is missing a description", + subcommand.name() + ); + } + + assert!( + signature.options().iter().any(|opt| opt.has_name("-help")), + "openssl signature is missing the top-level -help flag" + ); + } + /// Ensures no unquoted '\n' can be found. fn has_unsafe_newlines(str: &str) -> bool { let mut quote_char: Option = None; From 5b46d89c910e2ca20c660b4ada8feddd836cdfec Mon Sep 17 00:00:00 2001 From: Oz Date: Thu, 6 Aug 2026 02:03:40 +0000 Subject: [PATCH 2/2] Rework: add skeyutl subcommand; remove regression test per requester - Add the openssl 3.5 subcommand skeyutl (Perform opaque symmetric key (EVP_SKEY) operations) so the top-level list is complete for users on the current LTS. - Remove the openssl_signature_has_top_level_subcommands_and_flags test at the requester's explicit request; the PR is now a data-only change to command-signatures/json/openssl.json. The repo's existing deserialization/generator invariants remain the coverage. Co-Authored-By: Warp Agent --- command-signatures/json/openssl.json | 4 +++ command-signatures/src/lib.rs | 37 ---------------------------- 2 files changed, 4 insertions(+), 37 deletions(-) diff --git a/command-signatures/json/openssl.json b/command-signatures/json/openssl.json index d6fb2ac5..f5378824 100644 --- a/command-signatures/json/openssl.json +++ b/command-signatures/json/openssl.json @@ -184,6 +184,10 @@ "name": "sess_id", "description": "SSL/TLS session handling" }, + { + "name": "skeyutl", + "description": "Perform opaque symmetric key (EVP_SKEY) operations" + }, { "name": "smime", "description": "S/MIME message processing" diff --git a/command-signatures/src/lib.rs b/command-signatures/src/lib.rs index 3e01c32f..b0a74f1d 100644 --- a/command-signatures/src/lib.rs +++ b/command-signatures/src/lib.rs @@ -157,43 +157,6 @@ mod tests { } } - /// Regression test for the top-level `openssl` signature (APP-3963): it must - /// expose its subcommand list (each with a description) and the global - /// `-help` flag, so `openssl ` surfaces subcommands and top-level flags. - #[test] - fn openssl_signature_has_top_level_subcommands_and_flags() { - let signature = - signature_by_name("openssl").expect("openssl signature should exist and deserialize"); - - let subcommand_names: HashSet<&str> = - signature.subcommands().iter().map(|s| s.name()).collect(); - for expected in [ - "req", "x509", "genrsa", "genpkey", "s_client", "s_server", "enc", "dgst", "verify", - "ca", "pkcs12", "rsa", "ec", "ecparam", "pkey", "list", "version", - ] { - assert!( - subcommand_names.contains(expected), - "openssl signature is missing the `{expected}` subcommand" - ); - } - - for subcommand in signature.subcommands() { - assert!( - subcommand - .description - .as_deref() - .is_some_and(|d| !d.is_empty()), - "openssl subcommand `{}` is missing a description", - subcommand.name() - ); - } - - assert!( - signature.options().iter().any(|opt| opt.has_name("-help")), - "openssl signature is missing the top-level -help flag" - ); - } - /// Ensures no unquoted '\n' can be found. fn has_unsafe_newlines(str: &str) -> bool { let mut quote_char: Option = None;