From 895f3fa918150ed6e21438a0458530b2836499bc Mon Sep 17 00:00:00 2001 From: Shelley Vohr Date: Sat, 5 Sep 2026 09:30:10 +0000 Subject: [PATCH 1/2] test: expect seed-only PQC PKCS#8 export with BoringSSL test-crypto-pqc-key-objects-ml-dsa and -ml-kem compare a seeded key's PKCS#8 export against the seed+expanded fixture on every backend. BoringSSL only writes the seed-only encoding, so expect the private_seed_only fixture there. main expects seed-only on every backend since https://github.com/nodejs/node/pull/62178, which is semver-major, so the BoringSSL support backported in https://github.com/nodejs/node/pull/63563 kept the old expectation. Refs: https://github.com/nodejs/node/pull/63563 Signed-off-by: Shelley Vohr --- test/parallel/test-crypto-pqc-key-objects-ml-dsa.js | 3 ++- test/parallel/test-crypto-pqc-key-objects-ml-kem.js | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js index 883c2b712384..8a30a2f44bd8 100644 --- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js +++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js @@ -79,7 +79,8 @@ for (const [asymmetricKeyType, pubLen] of [ assertPublicKey(createPublicKey(key)); key.export({ format: 'der', type: 'pkcs8' }); if (hasSeed) { - assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private); + const expectedPkcs8 = process.features.openssl_is_boringssl ? keys.private_seed_only : keys.private; + assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), expectedPkcs8); const jwk = key.export({ format: 'jwk' }); assertPrivateJwk(jwk); assert.strictEqual(key.equals(createPrivateKey({ format: 'jwk', key: jwk })), true); diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js index de0755ca652c..6bde7c209ded 100644 --- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js +++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js @@ -79,7 +79,8 @@ for (const [asymmetricKeyType, pubLen] of [ assertPublicKey(createPublicKey(key)); key.export({ format: 'der', type: 'pkcs8' }); if (hasSeed) { - assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private); + const expectedPkcs8 = process.features.openssl_is_boringssl ? keys.private_seed_only : keys.private; + assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), expectedPkcs8); const jwk = key.export({ format: 'jwk' }); assertPrivateJwk(jwk); assert.strictEqual(key.equals(createPrivateKey({ format: 'jwk', key: jwk })), true); From efc02c2f9f4619de7054b5dd128d94f80600040c Mon Sep 17 00:00:00 2001 From: Shelley Vohr Date: Sat, 5 Sep 2026 09:30:10 +0000 Subject: [PATCH 2/2] test: skip RSA-PSS keygen deprecation tests with BoringSSL test-crypto-keygen-deprecation and test-crypto-keygen-duplicate-deprecated-option generate rsa-pss key pairs, which BoringSSL does not support. The other rsa-pss keygen tests skip there since https://github.com/nodejs/node/pull/62883, but these two only exist on v24.x (https://github.com/nodejs/node/pull/58706 removed them from main earlier), so its backport could not cover them. Refs: https://github.com/nodejs/node/pull/62883 Signed-off-by: Shelley Vohr --- test/parallel/test-crypto-keygen-deprecation.js | 3 +++ .../parallel/test-crypto-keygen-duplicate-deprecated-option.js | 3 +++ 2 files changed, 6 insertions(+) diff --git a/test/parallel/test-crypto-keygen-deprecation.js b/test/parallel/test-crypto-keygen-deprecation.js index 926dfbbc4ae9..da03cbc3445d 100644 --- a/test/parallel/test-crypto-keygen-deprecation.js +++ b/test/parallel/test-crypto-keygen-deprecation.js @@ -4,6 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); +if (process.features.openssl_is_boringssl) + common.skip('BoringSSL does not support RSA-PSS key pair generation'); + const DeprecationWarning = []; DeprecationWarning.push([ '"options.hash" is deprecated, use "options.hashAlgorithm" instead.', diff --git a/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js b/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js index 854ad6e35efc..ee1a722f4d1f 100644 --- a/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js +++ b/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js @@ -4,6 +4,9 @@ const common = require('../common'); if (!common.hasCrypto) common.skip('missing crypto'); +if (process.features.openssl_is_boringssl) + common.skip('BoringSSL does not support RSA-PSS key pair generation'); + const assert = require('assert'); const { generateKeyPair,