From: Theo Buehler <tb@theobuehler.org>
Subject: rpki-client: sha256 algorithmIdentifier tweak
To: tech@openbsd.org
Date: Wed, 14 Oct 2026 09:45:11 +0200

This makes cbs_is_sha256_algorithmIdentifier_value() use the same logic
as is used for for sha256WithRSAEncryption a few lines below. For the
latter this is now simply an RFC requirement as ARIN fixed their objects
with absent parameters in sha256WithRSAEncryption. However, they still
have tons of sha256 with incorrectly encoded parameters (as do many
others).

Index: cms.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/cms.c,v
diff -u -p -r1.72 cms.c
--- cms.c	14 Oct 2026 06:52:16 -0000	1.72
+++ cms.c	14 Oct 2026 07:36:29 -0000
@@ -101,10 +101,7 @@ cbs_is_sha256_algorithmIdentifier_value(
 		return 0;
 
 	/* Long live Postel's Law - cf., e.g., RFC 5754, section 2. */
-	if (param_present)
-		return CBS_len(&param) == 0;
-
-	return 1;
+	return !param_present || CBS_len(&param) == 0;
 }
 
 static int