Repository navigation
Stdlib: openssl_pkey_new() JIT/AOT happy-path leftover of #33530 — OpenSSLAsymmetricKey object AOT (ext/openssl/openssl.c) #34015
Description
Category
bug · AOT unimplemented · php-src-strict · leftover of #33530 / #6295
Problem
#33530 baked catchable argc/TypeError paths for openssl_pkey_new(), but the happy path still throws at compile time:
openssl_pkey_new() is not implemented for JIT in this compiler build (issue #6295/#22335/#33530)
VM matches Zend (OpenSSLAsymmetricKey + exportable PEM). Thin AOT cannot compile keygen, which blocks real TLS/crypto programs.
| Repro | Zend 8.2+ / VM | AOT thin (master @ e861c86) |
|---|---|---|
echo get_class(openssl_pkey_new()); |
OpenSSLAsymmetricKey |
compile LogicException |
openssl_pkey_new(null) |
object | compile LogicException |
openssl_pkey_new(['private_key_bits'=>512]) |
object | wrong runtime TypeError (mixed) or LogicException |
./script/aot-smoke.sh is 8/8 — feature gap, not the linker.
php-src reference
- php/php-src
ext/openssl/openssl.c—PHP_FUNCTION(openssl_pkey_new) - php/php-src
ext/openssl/openssl.stub.php—openssl_pkey_new(?array $options = null): OpenSSLAsymmetricKey|false
PHP implementation target
ext/openssl/openssl_pkey_new.php— replace happy-path LogicException with NestedJIT/object bake (peerhash_init/ HashContext)- Store PEM on
OpenSSLAsymmetricKey(property or side-channel readable from AOT); updateVmOpensslObjects::keyPem() - Prefer PHP-in-PHP + existing
VmOpensslPkeyNative::generateRsa— no newruntime/*.c
Repro
./script/docker-exec.sh -- bash -lc 'printf "%s\n" "<?php" "\$k = openssl_pkey_new();" "echo get_class(\$k), PHP_EOL;" > /tmp/pk.php; php bin/compile.php -o /tmp/pk.bin /tmp/pk.php && /tmp/pk.bin'Done when
- AOT
get_class(openssl_pkey_new())printsOpenSSLAsymmetricKey(rc=0) - AOT
openssl_pkey_new(null)same - Keys differ across process runs (runtime generation, not compile-time constant)
-
./script/aot-smoke.shstays 8/8 - Repro under
test/repro/
Parent
- Leftover of Stdlib: openssl_pkey_new() JIT leftover of #6295 — AOT LogicException (ext/openssl/openssl.c) #33530 (argc/TypeError only)
- VM lifecycle Stdlib: openssl_pkey_new/openssl_pkey_get_private/openssl_pkey_export — key pair API missing (ext/openssl/xp.c) #6295; EC/DH Regression: openssl_pkey_new rejects OPENSSL_KEYTYPE_EC/DH — Unknown private key type (ext/openssl/openssl.c) #22335
Activity
PurHur commentedon Aug 23, 2026
claim: I/O-crypto-text lane — north-star #32122/#31968 closed; implementing openssl_pkey_new happy-path NestedJIT + OpenSSLAsymmetricKey PEM property AOT (#34015 leftover of #33530).
PurHur commentedon Aug 23, 2026
claim: stdlib+AOT builtins lane — continuing #34015 (prior I/O-crypto claim, no branch/PR yet). Implementing openssl_pkey_new happy-path NestedJIT + OpenSSLAsymmetricKey AOT.
Stdlib: openssl_pkey_new JIT/AOT happy-path OpenSSLAsymmetricKey (#34015
PurHur commentedon Aug 23, 2026
Reopening: #34023 closed this with a compile-time PEM bake for thin AOT (
JitOpensslPkeyNew::generateThinAotBaked). That fails Done-when “Keys differ across process runs (runtime generation, not compile-time constant)”.Verified on master @ a767add:
stringson the AOT binary showsBEGIN PRIVATE KEY(two baked PEMs for the two calls)nmhas noEVP_PKEY_keygenFix: runtime libcrypto
EVP_PKEY_keygenleaf (peerJitOpensslSignKernel), not NestedJIT FFI / bake.PurHur commentedon Aug 23, 2026
claim: stdlib+AOT builtins — replacing thin-AOT compile-time PEM bake with runtime EVP_PKEY_keygen LLVM leaf so keys differ across process runs (#34015 Done-when).
Stdlib: openssl_pkey_new thin AOT uses runtime EVP keygen (#34015) (#…
Stdlib: openssl_pkey_get_details thin AOT via libcrypto leaves (#34030)…
AOT: openssl_pkey_new($options) runtime array leftover of #34015 (#35866