[atharvjairath]

What

Implement X509_verify_cert_error_string_nid_postfix, so callers receive the LibreSSL 2.5.4 diagnostic instead of an unsupported-export exception. The implementation covers all 54 named messages, the numeric fallback (including code 1 and newer error codes), low-32-bit lookup with a 64-bit guest argument, and the shared fallback-buffer lifetime.

The contract comes from LibreSSL 2.5.4 x509_txt.c and its error constants. Published firmware 13.40 measurements identify libSceLibreSsl as 2.5.4. I have not independently measured this export on a console; that limitation and the upstream shared-buffer concurrency restriction are recorded in the existing debt file.

The existing progress scanner counts one additional completed export (libSceLibreSsl: 23 to 24 of 399), approximately +0.009 percentage points overall. This is a function-coverage measure, not a game-compatibility claim. No dependency on #10047 or #10056.

Tested

Tested head: 30ab85a8db3496c937d4f701bdd28c1c365524df, rebased onto main e3d03fbae64e1b49e5d4e84e753ccce6edf60da5 after #9047 merged. Main's DES implementation, test registration and debt entry are preserved; pending-export counts are reconciled. The original PR head is retained as a local recovery reference.

• Linux x86-64, Ubuntu 24.04/GCC 13.3 Release under QEMU 11.0.3 on Apple Silicon: 5/5 tests pass, 0.94 s total.
• Windows x86-64, WinLibs GCC 15.2.0 UCRT r7 Release binaries executed through Wine 9/QEMU 11.0.3: 5/5 tests pass, 16.99 s total.
• Each suite runs this PR's certificate error-string test, LibreSSL digests, the newly merged DES test, LibreSSL3 digests and constant-time comparison. All 54 message hashes, signed/high-bit aliases, unknown-code ranges, 64-bit formatting and static-buffer lifetime remain covered.
• The original regression-control result remains applicable to the original stub: the same new test failed with the export's not implemented exception before implementation. This refresh reruns the complete focused suite on the head above.
• Conventions and git diff --check pass. The refreshed overlap scan reports debt-count conflicts with feat(libSceLibreSsl): implement ASN.1 integer and string helpers #10005/feat(libSceLibreSsl): implement AES key schedule, block and mode functions #10151. I inspected the shared-file diffs of base-conflicted feat(libSceLibreSsl): implement the low-level AES functions #9033/feat(libSceLibreSsl): implement RAND and the CRYPTO allocator functions #9041/feat(libSceLibreSsl): implement the BN_ BIGNUM, BN_CTX, conversion, word, BN_mul and BN_mod_inverse functions #9446/feat(libSceLibreSsl): implement the EVP message digest and HMAC functions #9448/feat(libSceLibreSsl): implement the per-thread error queue #9529/feat(libSceLibreSsl): implement CMAC with AES-CBC methods #9571/feat(libSceLibreSsl): return the measured version from SSLeay #9745/feat(libSceLibreSsl): implement TLS alert descriptions #9870/feat(libSceLibreSsl): implement five custom UI method functions #9942/feat(libSceLibreSsl): implement the OCSP status and reason strings #9949/feat(libressl3): report OpenSSL version strings #9970 and the other two independent LibreSSL follow-ups: none implements this PR's exports. Shared include declarations, CMake test insertions and debt counts will need reconciliation as those PRs land. The scan also lists this PR's pre-rebase revision as a self-comparison; that is not competing work.

These are focused builds of the real libSceLibreSsl, libSceLibreSsl3 and complete libc targets. They now configure main's SSL backend to build the repository-pinned mbedTLS crypto dependency from source, alongside pinned ZArchive/zstd; there are no library-behavior or exception-sentinel mocks. Whole-project configuration remains blocked by uninitialized SDL2 and missing XRandR development support. No whole-project, native Windows desktop, title or console run is claimed. A collaborator must dispatch the upstream Build workflow for full Linux/Windows CI.

Focused runtime build recipe

Use the following CMake project outside the source tree, with the repository-pinned ZArchive, zstd and mbedTLS checkouts under its 3rdparty/ directory (mbedTLS 068ff080b369adfac81509f9b57b2afabaf82dc5, including its pinned framework submodule):

cmake_minimum_required(VERSION 3.20)
project(X509Validation LANGUAGES CXX)
enable_testing()
set(CMAKE_CXX_STANDARD 20)
set(BUILD_TESTING ON)
set(ANYPS5_SOURCE_ROOT /src CACHE PATH "AnyPS5 source checkout")
set(LIBS_INCLUDE_DIR ${ANYPS5_SOURCE_ROOT}/core/libs)
set(ANYPS5_TEST_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests)
set(ANYPS5_WINDOWS_TEST_EXIT ${ANYPS5_SOURCE_ROOT}/cmake/WindowsTestExit.cpp)
add_compile_options(-ffunction-sections -fdata-sections)
add_link_options(-Wl,--gc-sections)
function(add_test_executable target)
    add_executable(${target} ${ARGN})
    set_target_properties(${target} PROPERTIES RUNTIME_OUTPUT_DIRECTORY "$<1:${ANYPS5_TEST_OUTPUT_DIRECTORY}>")
    if(MINGW)
        target_sources(${target} PRIVATE "${ANYPS5_WINDOWS_TEST_EXIT}")
        target_link_options(${target} PRIVATE LINKER:--wrap=main)
    endif()
endfunction()
function(add_asan_test_options test options)
    if(ANYPS5_ENABLE_ASAN)
        set_property(TEST ${test} APPEND PROPERTY ENVIRONMENT_MODIFICATION "ASAN_OPTIONS=string_append::${options}")
    endif()
endfunction()
function(configure_windows_unwind target)
    if(MINGW)
        if(NOT EXISTS "${CMAKE_OBJCOPY}")
            message(FATAL_ERROR "Windows DWARF unwinding requires objcopy")
        endif()
        add_custom_command(TARGET ${target} POST_BUILD
                COMMAND "${CMAKE_OBJCOPY}" --rename-section .eh_frame=.ehfram --rename-section .eh_fram=.ehfram "$<TARGET_FILE:${target}>"
                VERBATIM
        )
    endif()
endfunction()
if(MINGW)
    add_compile_options(-fno-asynchronous-unwind-tables)
endif()
include(${ANYPS5_SOURCE_ROOT}/cmake/ZArchive.cmake)
set(BUILD_TESTING OFF)
add_library(libc SHARED)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libc libc)
configure_windows_unwind(libc)
if(WIN32)
    target_compile_options(libc PRIVATE "SHELL:-include ${LIBS_INCLUDE_DIR}/prx/libc/include/HostStandardStreams.hpp")
endif()
if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
    target_link_options(libc PRIVATE LINKER:-z,now)
    target_link_options(libc INTERFACE LINKER:--no-as-needed)
endif()
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceSsl ssl)
set(BUILD_TESTING ON)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl libressl)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl3 libressl3)
foreach(target IN ITEMS libSceLibreSsl libSceLibreSsl3)
    target_link_libraries(${target} PUBLIC libc)
    if(WIN32)
        target_compile_options(${target} PRIVATE "SHELL:-include ${LIBS_INCLUDE_DIR}/prx/libc/include/HostStandardStreams.hpp")
    endif()
endforeach()

Configure with -DANYPS5_SOURCE_ROOT=<checkout> -DCMAKE_BUILD_TYPE=Release, build, then run ctest --test-dir <build> --output-on-failure. On Linux in this environment, CMAKE_CROSSCOMPILING_EMULATOR points to QEMU x86-64. Windows uses WinLibs GCC 15.2.0 UCRT r7; the Windows test executables run through Wine 9 under QEMU, with the build directory, both LibreSSL library directories and the WinLibs bin directory on WINEPATH. Each test keeps its repository timeout.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Progress report (f40cdeb → 30ab85a)

📈 System libraries: 46.68% (+0.01%, +1 implemented functions)

✅ 1 implemented

Library	Name
libSceLibreSsl	X509_verify_cert_error_string_nid_postfix

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 9529	docs/dev/debt/libSceLibreSsl.md L5, L7
PR 9949	docs/dev/debt/libSceLibreSsl.md L5, L7
PR 10005	docs/dev/debt/libSceLibreSsl.md L5, L7

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 9033	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9041	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9446	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9448	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9571	core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9745	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9870	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9942	core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md