From fde49578ecd635e29934fef1912db3b0c822a8a5 Mon Sep 17 00:00:00 2001
From: Toddr Bot <toddbot@rinaldo.us>
Date: Wed, 18 Mar 2026 20:32:30 +0000
Subject: [PATCH 1/2] fix: migrate SHA* digests to EVP_Q_digest on OpenSSL 3.x
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SHA1(), SHA224(), SHA256(), SHA384(), and SHA512() are deprecated in
OpenSSL 3.0+. The MD5 and RIPEMD160 cases in get_message_digest() were
already migrated to EVP_Q_digest — apply the same treatment to all SHA
variants for consistency and to eliminate deprecation warnings on
OpenSSL 3.x builds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 RSA.xs | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/RSA.xs b/RSA.xs
index 6df60eb..16cb633 100644
--- a/RSA.xs
+++ b/RSA.xs
@@ -231,20 +231,40 @@ unsigned char* get_message_digest(SV* text_SV, int hash_method)
 #endif
             break;
         case NID_sha1:
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+            return EVP_Q_digest(NULL, "SHA1", NULL, text, text_length, md, NULL) ? md : NULL;
+#else
             return SHA1(text, text_length, md);
+#endif
             break;
 #ifdef SHA512_DIGEST_LENGTH
         case NID_sha224:
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+            return EVP_Q_digest(NULL, "SHA224", NULL, text, text_length, md, NULL) ? md : NULL;
+#else
             return SHA224(text, text_length, md);
+#endif
             break;
         case NID_sha256:
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+            return EVP_Q_digest(NULL, "SHA256", NULL, text, text_length, md, NULL) ? md : NULL;
+#else
             return SHA256(text, text_length, md);
+#endif
             break;
         case NID_sha384:
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+            return EVP_Q_digest(NULL, "SHA384", NULL, text, text_length, md, NULL) ? md : NULL;
+#else
             return SHA384(text, text_length, md);
+#endif
             break;
         case NID_sha512:
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+            return EVP_Q_digest(NULL, "SHA512", NULL, text, text_length, md, NULL) ? md : NULL;
+#else
             return SHA512(text, text_length, md);
+#endif
             break;
 #endif
         case NID_ripemd160:

From f57cbb0bacff88554f1a4d472e9945da95603911 Mon Sep 17 00:00:00 2001
From: Toddr Bot <toddbot@rinaldo.us>
Date: Thu, 19 Mar 2026 01:10:49 +0000
Subject: [PATCH 2/2] rebase: apply review feedback on #119

---
 RSA.xs | 50 ++++++++++++++++++++++++--------------------------
 1 file changed, 24 insertions(+), 26 deletions(-)

diff --git a/RSA.xs b/RSA.xs
index 16cb633..cfb03b3 100644
--- a/RSA.xs
+++ b/RSA.xs
@@ -223,57 +223,55 @@ unsigned char* get_message_digest(SV* text_SV, int hash_method)
 
     switch(hash_method)
     {
-        case NID_md5:
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+        case NID_md5:
             return EVP_Q_digest(NULL, "MD5", NULL, text, text_length, md, NULL) ? md : NULL;
-#else
-            return MD5(text, text_length, md);
-#endif
             break;
         case NID_sha1:
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
             return EVP_Q_digest(NULL, "SHA1", NULL, text, text_length, md, NULL) ? md : NULL;
-#else
-            return SHA1(text, text_length, md);
-#endif
             break;
 #ifdef SHA512_DIGEST_LENGTH
         case NID_sha224:
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
             return EVP_Q_digest(NULL, "SHA224", NULL, text, text_length, md, NULL) ? md : NULL;
-#else
-            return SHA224(text, text_length, md);
-#endif
             break;
         case NID_sha256:
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
             return EVP_Q_digest(NULL, "SHA256", NULL, text, text_length, md, NULL) ? md : NULL;
-#else
-            return SHA256(text, text_length, md);
-#endif
             break;
         case NID_sha384:
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
             return EVP_Q_digest(NULL, "SHA384", NULL, text, text_length, md, NULL) ? md : NULL;
-#else
-            return SHA384(text, text_length, md);
-#endif
             break;
         case NID_sha512:
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
             return EVP_Q_digest(NULL, "SHA512", NULL, text, text_length, md, NULL) ? md : NULL;
-#else
-            return SHA512(text, text_length, md);
-#endif
             break;
 #endif
         case NID_ripemd160:
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
             return EVP_Q_digest(NULL, "RIPEMD160", NULL, text, text_length, md, NULL) ? md : NULL;
+            break;
 #else
-            return RIPEMD160(text, text_length, md);
+        case NID_md5:
+            return MD5(text, text_length, md);
+            break;
+        case NID_sha1:
+            return SHA1(text, text_length, md);
+            break;
+#ifdef SHA512_DIGEST_LENGTH
+        case NID_sha224:
+            return SHA224(text, text_length, md);
+            break;
+        case NID_sha256:
+            return SHA256(text, text_length, md);
+            break;
+        case NID_sha384:
+            return SHA384(text, text_length, md);
+            break;
+        case NID_sha512:
+            return SHA512(text, text_length, md);
+            break;
 #endif
+        case NID_ripemd160:
+            return RIPEMD160(text, text_length, md);
             break;
+#endif
 #ifdef WHIRLPOOL_DIGEST_LENGTH
         case NID_whirlpool:
             return WHIRLPOOL(text, text_length, md);