[From nobody Sat Jul 25 17:51:05 2026
Received: (at submit) by bugs.debian.org; 13 Jul 2026 20:53:50 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-19.9 required=4.0 tests=BAYES_00,
 BODY_INCLUDES_PACKAGE,FOURLA,FVGT_m_MULTI_ODD,HAS_PACKAGE,PGPSIGNATURE,
 SPF_HELO_PASS,SPF_PASS,WEIRD_PORT autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 26; hammy, 150; neutral, 152; spammy,
 0. spammytokens: hammytokens:0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug, 0.000-+--H*Ad:N*Tracking,
 0.000-+--HTo:N*Debian
Return-path: <debian.axhn@manchmal.in-ulm.de>
Received: from manchmal.in-ulm.de ([217.10.9.201]:35276)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <debian.axhn@manchmal.in-ulm.de>)
 id 1wjNew-0073ck-1O for submit@bugs.debian.org;
 Mon, 13 Jul 2026 20:53:50 +0000
Date: Mon, 13 Jul 2026 22:53:44 +0200
From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Can no longer parse RSA private keys with additional text
Message-ID: <1783975955@msgid.manchmal.in-ulm.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="jESYuWbO8/VWV4sl"
Content-Disposition: inline
Delivered-To: submit@bugs.debian.org


--jESYuWbO8/VWV4sl
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Package: libcrypt-openssl-rsa-perl
Version: 0.41-1
Severity: important
Tags: upstream
X-Debbugs-Cc: debian.axhn@manchmal.in-ulm.de

Greetings,

it seems Crypt::OpenSSL::RSA::new_private_key can no longer handle a
private key in the PEM format with additional text - like it used to
since possibly the last ten years.

How to repeat:

Generate an according key. Using GnuTLS that's

    certtool --generate-privkey --outfile /tmp/privkey.pem

Or, using OpenSSL and an exsting key:

    openssl rsa -text </path/to/some-private-key  >/tmp/privkey.pem

Then run

    perl parse-key /tmp/privkey.pem

where parse-key:

```
#!/usr/bin/perl

use 5.010;
use strict;
use warnings;

use Crypt::OpenSSL::RSA;
use File::Slurp;
use Test::More;

diag ("Version: $Crypt::OpenSSL::RSA::VERSION");

my $rsa = eval {
    my $content = read_file ($ARGV[0]);
    Crypt::OpenSSL::RSA->new_private_key ($content);
};

ok (defined ($rsa)) or diag ($@);

done_testing;
```

Expected (using Debian 14, "forky"):

```
# Version: 0.35
ok 1
1..1
```

Got (using Debian unstable):

```
# Version: 0.41
not ok 1
#   Failed test at parse-key line 18.
# unrecognized key format: expected PEM-encoded key (starting with '-----BEGIN') or DER-encoded key (binary ASN.1 data) at parse-key line 15.
1..1
# Looks like you failed 1 test of 1.
```


To be honest, I didn't spend much time in investigation. It seems the
new_private_key method exists in the newer version only - perhaps it
used to be pure XS code in the past that was more flexible in that
regard?

This however fixes the issue for me:

[ RSA.pm:61 ]
-    if ( $p_key_string =~ /^-----/ ) {
+    if ( $p_key_string =~ /^-----/m ) {

Cheers,

    Christoph

-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.94 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_WARN
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libcrypt-openssl-rsa-perl depends on:
ii  libc6                                       2.42-17
ii  libcrypt-openssl-bignum-perl                0.09-2+b4
ii  libcrypt-openssl-random-perl                0.17-1+b3
ii  libssl3t64                                  3.6.3-1
ii  perl                                        5.40.1-8
ii  perl-base [perlapi-5.40.1]                  5.40.1-8
ii  perl-openssl-defaults [perl-openssl-abi-3]  7+b2

libcrypt-openssl-rsa-perl recommends no packages.

libcrypt-openssl-rsa-perl suggests no packages.

-- no debconf information


--jESYuWbO8/VWV4sl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAmpVUFIACgkQxCxY61kU
kv24dQ/+OfR2aiGgrfdmPPiLbzEeFYgNyl6PyQ4/R1KEdHXKwW95zh70mKP99+IY
9A8OpoauC8tbdzJJOTn1mx0YpCiuDjJp+nLNyXSocqc8qufgLohvVoQ1C6ZdUDRw
rGs262qRIfBy64pP3++wtfsmZsjy39VJa6ivMtYdRoQ2ujjG1LiOjniQ5zTAPTxM
tKeMUL0VzI8ksnnbCCi4awlfaU3FTwfjNNwzLg+5Xj8jXs9DMYkBxk9/46IDcX52
KXqflX1VgkGtkjAc9JbEwJwsLT8a/elId3CZatzluytZReZ3TEiU0MPFRtgeKQKh
gF9d9lGbyvPEAZREMBw7taIYI49Q3qt+55E873e+zzgFS8OQUm10nZjvAxvNkWd7
QnYQlCVoWyIMUAJP38BWk1b3kg6LY+HE8wLm2kewNaSlV+5439M1BbLgEM70Skh4
xdv8yDlE1a2dosIaAkNzBfWFDkTIWfF7zmffQGizJQCS3rWOZxi5sj5YVbGAJJCj
VFg9vhnQj8sj8AA0mO/K6PxizhP6OPOUSk0GX8VgNsfin6ZDorro+L+jLWwl6H3+
XzDZWRK/mfQofUmifIwez2vkQAOG6IuFrw+CQTnoYUB8Ukvg2Qwm1qTjfFMxTaO7
DKUb3UDGeDThpEWRjFcqXOvP4C6oagOkrKPCV+MnzpNicfYlhpc=
=kUqi
-----END PGP SIGNATURE-----

--jESYuWbO8/VWV4sl--
]