[alvaroelpob]

What

Implements OCSP_response_status and OCSP_single_get0_status in libSceLibreSsl, which threw and were declared without parameters.

The module is LibreSSL 2.5.4 (firmware 13.40 measurements in #8981). Signatures, layouts and results follow that release's ocsp.h, ocsp_cl.c and a_enum.c:

Export	Behaviour
int OCSP_response_status(OCSP_RESPONSE*)	ASN1_ENUMERATED_get(responseStatus), truncated to int
int OCSP_single_get0_status(OCSP_SINGLERESP*, int* reason, ASN1_GENERALIZEDTIME** revtime, ASN1_GENERALIZEDTIME** thisupd, ASN1_GENERALIZEDTIME** nextupd)	-1 for a null single response; otherwise returns certStatus->type. For a revoked status it stores revocationTime and the enumerated reason, or -1 when there is no reason. It then stores thisUpdate and nextUpdate, writing only the outputs that aren't null

ASN1_ENUMERATED_get, which this module doesn't export, is reproduced for both: 0 for a null value or null data, -1 for a type other than V_ASN1_ENUMERATED (10) and V_ASN1_NEG_ENUMERATED (0x10A) or a length above 8 bytes, otherwise the big-endian bytes, negated for the negative type.

The layouts (ASN1_STRING 24 bytes, OCSP_RESPONSE 16, OCSP_CERTSTATUS 16 with the union at 8, OCSP_REVOKEDINFO 16, OCSP_SINGLERESP 40) are checked with static_asserts. LibreSSL dereferences a null response, a null certStatus, and a null revoked record when the time or reason is requested without checking them, so those throw. No export of this module decodes a response yet, so for now only structures built by the caller reach these functions.

The debt entry records the source and what is unverified, and the pending-export count drops by 2 (342 to 340 on current main). The OCSP string functions in #9949 live in src/Ocsp.cpp. This PR uses src/OcspResponse.cpp, so the two don't add the same file.

Tested

Ubuntu 26.04 (WSL2, kernel 6.18), GCC 15.2.0, Release, full build with BUILD_TESTING=ON on main e2b9700. There is one commit per function, and each adds that function with its test block and debt update. Each was built and its guest_libressl_ocsp_response test and check_conventions.py run on its own.

• New guest_libressl_ocsp_response test. OCSP_response_status is checked with one- and two-byte values, a negative enumerated value, a 5-byte value truncated to int, an 8-byte value with the top bit set, a 9-byte value (-1), zero length, null data, the wrong type (-1), and a null status (0); a null response throws. OCSP_single_get0_status returns -1 without writing for a null single response. For good and unknown it fills only thisupd and nextupd, leaving reason and revtime alone. For revoked it covers a reason, no reason (-1), a wrongly typed reason (-1) and null outputs. A revoked status with a null record throws only when the reason or time is requested, and a null certStatus throws. On main the first call throws.
• Full ctest -j16 at the last commit: 2003/2004 pass. agc_driver_multisample_retirement fails the same way on main on this machine.
• Not tested: Windows, a title.
• Rebased on main 1e740a2 (after feat(libSceLibreSsl): implement the low-level AES functions #9033), head ac9661e: the conflicts were only the add_library source list, the end of the test block, the pending-export count and the last debt entry; both sides are kept and the count is 357 minus this PR's exports. Full build and ctest -j16: 2043/2044 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Rebased on main e7e3e9c, head f28584b, to resolve the conflict from feat(libSceLibreSsl): implement the per-thread error queue #9529 on the shared CMakeLists.txt and debt-file lines; both sides are kept and the count is 353 minus this PR's exports. f28584b (refactor(libSceLibreSsl): declare the OCSP status exports in the public header) puts the real signatures and their structs in libSceLibreSsl/include/Api.hpp and drops the test's redeclarations, which public_headers requires since refactor(libs): add full export headers for libs #10706. Full build and ctest -j16: 2202/2203 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Rebased on main ae7d592 (after feat(libSceLibreSsl): implement the OCSP status and reason strings #9949), head 2db1279, to resolve the conflicts with main on the shared CMakeLists.txt and debt-file lines; both sides are kept and the count is 342 minus this PR's exports. Full build and ctest -j16: 2275/2276 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Review fix 5ab224d drops LibreSslAsn1String and uses main's Asn1String (same 24-byte layout, asserted in Asn1.cpp) in the OCSP structs, signatures and test; guest_libressl_ocsp_response and public_headers pass. Full build and ctest -j16 on main ae7d592: 2275/2276 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Rebased on main 88795ed (after feat(libSceLibreSsl): implement the CRYPTO locking and thread id callbacks #10248; head 5b75985) to resolve the conflicts on the shared debt-file lines; both sides are kept and the count is 335 minus this PR's exports. Full build and ctest -j16: 2383/2384 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Rebased on main c7b4878 (after feat(libSceLibreSsl): implement sk_num, sk_value, sk_pop and sk_pop_free #10373, feat(libSceLibreSsl): implement UI_METHOD creation and its opener, writer, reader and closer accessors #10376 and feat(libSceLibreSsl): implement RSA_flags and RSA_size #10449), head f000377, to resolve the conflicts with main on the shared CMakeLists.txt, Api.hpp and debt-file lines; both sides are kept and the count is 319 minus this PR's exports. Full build and ctest -j16: 2394/2395 pass; agc_driver_multisample_retirement fails the same way on that main, and guest_pthread_start timed out once at 20 s while another full suite shared the machine; run alone with --repeat until-fail:3 it passes 3/3 in about 2 s. check_conventions.py --base upstream/main passes.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: feat(libSceLibreSsl): implement the BN_ BIGNUM, BN_CTX, conversion, word, BN_mul and BN_mod_inverse functions #9446, feat(libSceLibreSsl): implement the EVP message digest and HMAC functions #9448, feat(libSceLibreSsl): implement CMAC with AES-CBC methods #9571, feat(libressl): implement X509 extension getters #10078, feat(libSceLibreSsl): implement EC groups and keys for named curves #10395, feat(libSceLibreSsl): implement EVP_PKEY_id #10418
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[github-actions]

Progress report (aaccd0b → b6230f2)

📈 System libraries: 45.97% (+0.01%, +2 implemented functions)

✅ 2 implemented

Library	Name
libSceLibreSsl	OCSP_response_status_nid_postfix
libSceLibreSsl	OCSP_single_get0_status_nid_postfix

Changed libraries (implemented exports)

Library	Before	After	Change
libSceLibreSsl	90/401 (22.44%)	92/401 (22.94%)	+0.50 pp

[github-actions]

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 10508	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 10570	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 10571	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 10878	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 10915	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11003	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11128	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11146	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11151	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11174	core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11175	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11466	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11553	docs/dev/debt/libSceLibreSsl.md
PR 11662	core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 12774	core/libs/prx/libSceLibreSsl/CMakeLists.txt
PR 12775	core/libs/prx/libSceLibreSsl/CMakeLists.txt
PR 12844	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 12850	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 12928	core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 12999	core/libs/prx/libSceLibreSsl/CMakeLists.txt

[MarcZX10]

Reviewed exact head 9f5e341. I compared both implementations and the 24/16/40-byte guest layouts with the pinned LibreSSL 2.5.4 ocsp_cl.c, ocsp.h, and a_enum.c. The null-single return, raw certificate status, optional output writes, revoked reason handling, ASN.1 enum limits and values, and null-dereference cases match those sources. The only related open PR I found is #9949, which implements status/reason text conversion rather than these two functions.\n\nI compiled the exact changed implementation and supplied test with GCC 12.2, C++20, -Wall -Wextra -Werror; libSceLibreSsl OCSP response tests passed. This focused direct build used a temporary NotImplemented_nid_no_patch shim, so it does not validate full project linkage or exception integration. The exact-head conventions check passed. Hosted eligibility, conventions, intake, labels and report checks pass; full Linux/Windows product jobs are skipped under repository policy. The PR declares its LibreSSL dependency ordering. I found no blocking behavior issue.

[alvaroelpob]

Rebased on main 1e740a2 (head ac9661e) to resolve the conflict from #9033 on the shared CMakeLists.txt and debt-file lines. Full suite 2043/2044, with the same failure on main. Depends on drops #9033 and adds #9949.

[alvaroelpob]

Rebased on main e7e3e9c, head f28584b, to resolve the conflict from #9529 on the shared CMakeLists.txt and debt-file lines; both sides are kept and the count is 353 minus this PR's exports. #10706 now requires each export to be declared once in include/Api.hpp, so f28584b moves these signatures and their structs there and drops the test's redeclarations. Full suite 2202/2203, with the same failure on main. Depends on drops the merged #9529.

[alvaroelpob]

Rebased on main 88795ed (after #10248; head 5b75985) to resolve the conflicts on the shared debt-file lines; no change to this PR's functions. Full ctest -j16 2383/2384, agc_driver_multisample_retirement fails the same way on main.

[alvaroelpob]

Rebased on main c7b4878 (after #10373, #10376 and #10449; head f000377) to resolve the conflicts on the shared CMakeLists.txt, Api.hpp and debt-file lines; no change to this PR's functions. Full ctest -j16 2394/2395, agc_driver_multisample_retirement fails the same way on main. guest_pthread_start timed out once at 20 s while another full suite shared the machine; alone with --repeat until-fail:3 it passes 3/3.

[alvaroelpob]

Rebased on main 8ff4baf (head 635a3f6) to resolve the conflict from #10398 on the shared CMakeLists.txt and debt-file lines. #10398 made the same 319 to 318 edit as this branch, so the merge lost one decrement; 635a3f6 sets the count to 316, the exports that still throw. Depends on is now #9448, #9571, #10078, #10395, #10418, #10447. Full suite 2543/2544, with agc_driver_multisample_retirement failing on main too; conventions pass.

[oneandonlydean]

@alvaroelpob this no longer merges cleanly with current main (e52fd83): core/libs/prx/libSceLibreSsl/CMakeLists.txt, include/Api.hpp and docs/dev/debt/libSceLibreSsl.md conflict with #10447, #11340 and #11261, which landed since. The conflicts are in shared lists only, so keeping both sides should do. Could you rebase or merge main and push? Nothing else changes from the earlier review.

[alvaroelpob]

Rebased on main 3a40945 (head 5ff7f59) after #10447, #11340 and #11261; the conflicts were only in the shared CMakeLists.txt, include/Api.hpp and debt-file lists, and both sides are kept. No change to this PR's functions. Pending-export line recounted against main: 311 (313 minus the 2 this PR implements). Full ctest -j16 2693/2693 (main 2692/2692); conventions pass.

[alvaroelpob]

Rebased on main 4c7d275 (after #11105 and #11189; head b6230f2). The conflicts were only in the shared CMakeLists.txt, Export.cpp, include/Api.hpp and debt-file lines; both sides are kept and there is no change to this PR's functions. Pending-export line recounted against the stubs left in Export.cpp: 297. Full ctest -j16 2867/2868, with guest_freebsd_clocks failing on main too (2866/2867); conventions pass.

[MarcZX10]

Re-check — changes requested\n\nThe new report is useful: it says the implementation functions were preserved through the merge and the full test suite has the same single known failure as its tested main, with conventions passing. However, the tested integration point is 4c7d275; current upstream main is aaccd0b, and this PR head is 44 commits behind it.\n\nPlease update onto current main, preserve the implementation and debt-count changes, recount the pending exports against the resulting Export.cpp, and rerun the relevant LibreSSL tests plus conventions on the exact updated head. The earlier approval was for the prior head and does not cover this stale integration point. I did not rerun these checks locally.