[lib] refactor crypt.cpp, set minimal required OpenSSL version to 3.0

.github/workflows/linux.yml

@@ -210,7 +210,7 @@ jobs:
       - name: Install dependencies for unit testing
         if: success() && matrix.type == 'unit-test'
         run: |
-          sudo apt-get install -y libgtest-dev
+          sudo apt-get install -y libgtest-dev python3-openssl
 
       - name: Install dependencies for integration testing
         if: success() && matrix.type == 'integration-test'
@@ -458,7 +458,9 @@ jobs:
 
       - name: Execute automation tests
         if: success() && matrix.type == 'unit-test'
-        run: python ./tests/crypt_prog_tests.py ./lib/crypt_prog
+        run: |
+          python ./tests/crypt_prog_tests.py ./lib/crypt_prog
+          python ./tests/sign_executable_tests.py ./tools/sign_executable ./lib/crypt_prog
 
       - name: Execute integration-test
         if: success() && matrix.type == 'integration-test'

.github/workflows/windows.yml

@@ -133,6 +133,8 @@ jobs:
         if: success() && matrix.platform == 'x64' && matrix.configuration == 'Release'
         working-directory: win_build\Build\${{matrix.platform}}\${{matrix.configuration}}
         run: |
+          python -m pip install pyopenssl
+          python -m pip install cryptography
           ${{github.workspace}}\temp\OpenCppCoverage\OpenCppCoverage.exe --cover_children --optimized_build --modules ${{github.workspace}} --sources ${{github.workspace}} --input_coverage=gtest.cov --export_type=cobertura:cobertura.xml -- python ${{github.workspace}}\tests\crypt_prog_tests.py ${{github.workspace}}\win_build\Build\x64\${{matrix.configuration}}\crypt_prog.exe
 
       - name: Verify MSI file

client/acct_mgr.cpp

@@ -1,6 +1,6 @@
 // This file is part of BOINC.
-// http://boinc.berkeley.edu
-// Copyright (C) 2017 University of California
+// https://boinc.berkeley.edu
+// Copyright (C) 2026 University of California
 //
 // BOINC is free software; you can redistribute it and/or modify it
 // under the terms of the GNU Lesser General Public License
@@ -765,8 +765,8 @@ void ACCT_MGR_OP::handle_reply(int http_op_retval) {
                     continue;
                 }
 
-                retval = check_string_signature2(
-                    acct.url.c_str(), acct.url_signature, ami.signing_key, verified
+                std::tie(retval, verified) = check_string_signature(
+                    acct.url, acct.url_signature, ami.signing_key
                 );
                 if (retval || !verified) {
                     msg_printf(NULL, MSG_INTERNAL_ERROR,

client/async_file.cpp

@@ -1,6 +1,6 @@
 // This file is part of BOINC.
-// http://boinc.berkeley.edu
-// Copyright (C) 2012 University of California
+// https://boinc.berkeley.edu
+// Copyright (C) 2026 University of California
 //
 // BOINC is free software; you can redistribute it and/or modify it
 // under the terms of the GNU Lesser General Public License
@@ -229,10 +229,9 @@ void ASYNC_VERIFY::finish() {
     }
     md5_buf[32] = 0;
     if (fip->signature_required) {
-        bool verified;
-        retval = check_file_signature2(md5_buf, fip->file_signature,
-            fip->project->code_sign_key, verified
-        );
+        bool verified = false;
+        std::tie(retval, verified) = check_file_signature(md5_buf,
+            fip->file_signature, fip->project->code_sign_key);
         if (retval) {
             error(retval);
             return;

client/cs_files.cpp

@@ -1,6 +1,6 @@
 // This file is part of BOINC.
 // https://boinc.berkeley.edu
-// Copyright (C) 2025 University of California
+// Copyright (C) 2026 University of California
 //
 // BOINC is free software; you can redistribute it and/or modify it
 // under the terms of the GNU Lesser General Public License
@@ -123,7 +123,7 @@ bool FILE_INFO::verify_file_certs() {
     if (!is_dir(CERTIFICATE_DIRECTORY)) return false;
     DIRREF dir = dir_open(CERTIFICATE_DIRECTORY);
     while (!dir_scan(file, dir, sizeof(file))) {
-        if (cert_verify_file(cert_sigs, file, CERTIFICATE_DIRECTORY)) {
+        if (!cert_verify_file(cert_sigs, file, CERTIFICATE_DIRECTORY)) {
             msg_printf(project, MSG_INFO,
                 "Signature verified using certificate %s", file
             );
@@ -302,9 +302,8 @@ int FILE_INFO::verify_file(
                 return retval;
             }
         }
-        retval = check_file_signature2(
-            cksum, file_signature, project->code_sign_key, verified
-        );
+        std::tie(retval, verified) = check_file_signature(
+            cksum, file_signature, project->code_sign_key);
         if (retval) {
             msg_printf(project, MSG_INTERNAL_ERROR,
                 "Signature verification error for %s",

client/cs_scheduler.cpp

@@ -1,6 +1,6 @@
 // This file is part of BOINC.
 // https://boinc.berkeley.edu
-// Copyright (C) 2025 University of California
+// Copyright (C) 2026 University of California
 //
 // BOINC is free software; you can redistribute it and/or modify it
 // under the terms of the GNU Lesser General Public License
@@ -826,9 +826,9 @@ int CLIENT_STATE::handle_scheduler_reply(
             safe_strcpy(project->code_sign_key, sr.code_sign_key);
         } else {
             if (sr.code_sign_key_signature) {
-                retval = check_string_signature2(
+                std::tie(retval, signature_valid) = check_string_signature(
                     sr.code_sign_key, sr.code_sign_key_signature,
-                    project->code_sign_key, signature_valid
+                    project->code_sign_key
                 );
                 if (!retval && signature_valid) {
                     safe_strcpy(project->code_sign_key, sr.code_sign_key);