safe-chains 0.221.0

[[command]]
name = "openssl"
description = "OpenSSL — cryptography toolkit. Sub-driven CLI with a separate command for each operation. Read-side subs include version, ciphers, list, engine, errstr, and the `-noout`-style read of x509 / pkey / req / crl / pkcs12 / pkcs7 / asn1parse / dgst. Write-side subs include req (with -new), x509 (with -req), genrsa, genpkey, gendsa, ecparam, ca, enc, pkcs12 (with -export), pkcs7, ts, rand, smime, cms, srp, dhparam, dsaparam, gendh. The s_client / s_server / ocsp subs make network connections; speed is a CPU-intensive benchmark; engine subs may invoke external libraries. Mature, ubiquitous."
url = "https://docs.openssl.org/master/man1/openssl/"
researched_version = "OpenSSL 3.x"
bare_flags = ["--help", "-help", "-version", "version"]
examples_safe = [
    "openssl enc -e -in x -out x.enc -k p",
    "openssl x509 -in c.pem -noout -text",
    "openssl genrsa 2048",
    "openssl rsa -in priv.pem -pubout",
]
examples_denied = [
    "openssl enc -d -in x.enc -k p",
    "openssl smime -decrypt -in m.p7 -inkey k.pem",
    "openssl cms -decrypt -in m -inkey k",
    "openssl rsa -in enc.pem -passin pass:x",
    "openssl rsa -in priv.pem -out /dev/stdout",
    "openssl rsa -in priv.pem -noout -text",
    "openssl pkey -in priv.pem",
]

[[command.sub]]
name = "version"
allow_all = true

[[command.sub]]
name = "help"
allow_all = true

[[command.sub]]
name = "ciphers"
allow_all = true

[[command.sub]]
name = "list"
allow_all = true

[[command.sub]]
name = "engine"
allow_all = true

[[command.sub]]
name = "errstr"
allow_all = true

[[command.sub]]
name = "x509"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "req"
allow_all = true
level = "SafeWrite"

# The DISCLOSURE-prone subs (pkey/rsa/ec/dsa/pkcs8/pkcs12, enc, smime, cms) are classified by the
# `resolve_openssl` ENGINE resolver (src/engine/resolve.rs), NOT declaratively: openssl's flag grammar
# (single-dash long opts `--d`==`-d`, the `-text` side channel that dumps private components past
# `-pubout`/`-noout`, and `-out` whose VALUE can be stdout) needs real logic. The resolver emits
# `decrypt-read` (→ yolo) only when private/decrypted material reaches the MODEL (stdout); public-key
# ops, to-FILE extraction, and encrypt/sign fall through to the `allow_all` entries below. These
# entries remain so the DOCS list the subs and the legacy path stays defined.
[[command.sub]]
name = "pkey"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "rsa"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "ec"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "dsa"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "dh"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "dhparam"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "dsaparam"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "ecparam"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "genrsa"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "genpkey"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "gendsa"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "gendh"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "crl"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "crl2pkcs7"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "pkcs7"
allow_all = true
level = "SafeWrite"

# pkcs8/pkcs12 private-key disclosure is classified by `resolve_openssl` (see the note above pkey).
[[command.sub]]
name = "pkcs8"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "pkcs12"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "asn1parse"
allow_all = true
level = "SafeRead"

[[command.sub]]
name = "dgst"
allow_all = true
level = "SafeWrite"

# `enc -d` decrypt disclosure is classified by `resolve_openssl` (see the note above pkey).
[[command.sub]]
name = "enc"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "rand"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "rehash"
allow_all = true
level = "SafeWrite"

# `smime -decrypt` / `cms -decrypt` / `cms -EncryptedData_decrypt` disclosure is classified by
# `resolve_openssl` (see the note above pkey).
[[command.sub]]
name = "smime"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "cms"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "ts"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "ca"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "verify"
allow_all = true
level = "SafeRead"

[[command.sub]]
name = "passwd"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "prime"
allow_all = true
level = "SafeRead"

[[command.sub]]
name = "kdf"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "mac"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "fipsinstall"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "info"
allow_all = true
level = "SafeRead"

[[command.sub]]
name = "nseq"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "spkac"
allow_all = true
level = "SafeWrite"

[[command.sub]]
name = "srp"
candidate = true

[[command.sub]]
name = "s_client"
candidate = true

[[command.sub]]
name = "s_server"
candidate = true

[[command.sub]]
name = "s_time"
candidate = true

[[command.sub]]
name = "ocsp"
candidate = true

[[command.sub]]
name = "speed"
candidate = true