From f671cea71baf64aeddf78543fc6c04155feebba0 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Mon, 24 Mar 2025 00:51:22 +0100
Subject: [PATCH 01/16] Close #602: Linux/Flatpak: default template TLS_server
 is missing

Add Linux INSTALL_DATA_PREFIX to the list of search paths
---
 lib/db_temp.cpp | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/db_temp.cpp b/lib/db_temp.cpp
index 412531bf..62d6819c 100644
--- a/lib/db_temp.cpp
+++ b/lib/db_temp.cpp
@@ -33,9 +33,14 @@ db_temp::db_temp() : db_x509name("templates")
 	tmpl->setAsPreDefined();
 	predefs << tmpl;
 
-	foreach(QString d, QStandardPaths::standardLocations(
-				QStandardPaths::AppDataLocation))
+	QStringList dirs = QStandardPaths::standardLocations(
+	                     QStandardPaths::AppDataLocation);
+#ifdef INSTALL_DATA_PREFIX
+	dirs << QString(INSTALL_DATA_PREFIX);
+#endif
+	foreach(QString d, dirs)
 	{
+		qDebug() << "Looking for templates at" << d;
 		QFileInfoList list = QDir(d).entryInfoList(
 				QStringList("*.xca"),
 				QDir::Files | QDir::NoSymLinks |

From caaea326a8e9f3b74f23b27eb25393d6a5a9edf6 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Thu, 24 Oct 2024 13:12:58 +0200
Subject: [PATCH 02/16] Free elements before exit of xcaexport app

Not very tragic, but the ASAN build fails otherwise.
---
 lib/xcaexport.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/xcaexport.cpp b/lib/xcaexport.cpp
index 9624bb66..b632da3a 100644
--- a/lib/xcaexport.cpp
+++ b/lib/xcaexport.cpp
@@ -55,5 +55,6 @@ int main(int argc, char *argv[])
 		QTextStream out(stdout);
 		out << doc;
 	}
+	pki_export::free_elements();
 	return EXIT_SUCCESS;
 }

From 58b2d713a1b14cafd5981410ae2d8cfe22edb13a Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Sun, 23 Mar 2025 16:32:27 +0100
Subject: [PATCH 03/16] Close #640: Fix mysql on Mac OSX

Replace the @rpath/libmariadb.3.dylib by "$INSTALL_DIR"/lib/libmariadb.3.dylib
in the self compiled plugin "libqsqlmysql.dylib" after installation in the
QTDIR plugin directory.

This provokes macdeployqt to install libmariadb.3.dylib to take
libmariadb.3.dylib into account and also install it and resolve all
referenced library paths.

Finally the absolute path will be replaced by the @rpath when
creating the xca.app.

Add tests for my HOME dir inside the installed binaries to
detect errors in the future.
---
 CMakeLists.txt       | 10 +++++++++-
 release/build-mac.sh | 10 +++++++---
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index a494bc13..8c70765e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -218,11 +218,20 @@ if(APPLE)
     RESOURCE "${APP_RESOURCES}"
   )
   find_program(MACDEPLOYQT_EXECUTABLE macdeployqt HINTS ${_qt_bin_dir})
+  find_program(INSTALL_NAME_TOOL install_name_tool HINTS ${_qt_bin_dir})
+
   add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
     COMMAND ${MACDEPLOYQT_EXECUTABLE} $<TARGET_FILE_DIR:${PROJECT_NAME}>/../..
         -always-overwrite ${APPSTORE}
     COMMENT "Running macdeployqt..."
   )
+  foreach(installdir ${CMAKE_PREFIX_PATH})
+    add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
+      COMMAND test ! -e $<TARGET_FILE_DIR:${PROJECT_NAME}>/../PlugIns/sqldrivers/libqsqlmysql.dylib ||
+          ${INSTALL_NAME_TOOL} -change ${installdir}/lib/libmariadb.3.dylib @rpath/libmariadb.3.dylib
+          $<TARGET_FILE_DIR:${PROJECT_NAME}>/../PlugIns/sqldrivers/libqsqlmysql.dylib
+    )
+  endforeach()
   if (PROVISIONPROFILE)
     add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
       COMMAND cmake -E copy ${PROVISIONPROFILE}
@@ -236,7 +245,6 @@ if(APPLE)
         --force -s ${APPLE_DEVELOPER_CERT}
         $<TARGET_FILE_DIR:${PROJECT_NAME}>/../..
       COMMENT "Running codesign for ${APPLE_DEVELOPER_CERT} ..."
-      DEPENDS ${PROJECT_SOURCE_DIR}/misc/entitlement${APPSTORE}.plist
     )
   endif()
 
diff --git a/release/build-mac.sh b/release/build-mac.sh
index ff474308..2ee2b241 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -95,12 +95,15 @@ do_qsqlmysql()
 
   cmake --build $SQL_BUILD -j$JOBS -v
   cmake --install $SQL_BUILD
-  install_name_tool -change @rpath/libmariadb.3.dylib\
+  # Replace @rpath name by full path in the installed file,
+  # to trigger macdeployqt to pick up this library.
+  # This is a hack, but it works. we need to revert it
+  # after macdeployqt has run.
+  install_name_tool -change @rpath/libmariadb.3.dylib \
                 "$INSTALL_DIR"/lib/libmariadb.3.dylib \
         $QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib
 
   file $QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib
-  file $SQL_BUILD/plugins/sqldrivers/libqsqlmysql.dylib
   otool -L $QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib
 }
 
@@ -126,7 +129,6 @@ do_openssl
 #    -qt_internal_force_macos_intel_arch(QMYSQLDriverPlugin)
 do_qsqlmysql
 
-
 cmake -B "$BUILDDIR" "$XCA_DIR" \
 	-DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" \
 	-DCMAKE_PREFIX_PATH="$QT_DIR/lib/cmake;$INSTALL_DIR" \
@@ -156,3 +158,5 @@ read xca_version < "$BUILDDIR_APPSTORE"/PKGVERSION.txt
 cmake --build "$BUILDDIR_APPSTORE" -j$JOBS
 productbuild --component "$BUILDDIR_APPSTORE/xca.app" /Applications \
     --sign "3rd Party Mac Developer Installer" "$BUILDDIR_APPSTORE/xca-${xca_version}-appstore.pkg"
+
+find "${BUILDDIR_APPSTORE}/xca.app" "${BUILDDIR}/xca.app" -name "*.dylib" | xargs otool -L | grep -E "/Applications/\|$HOME"

From 2cc90b8ac6e4fc40be51f159c8dd4eafe72c2029 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Sun, 23 Mar 2025 16:38:47 +0100
Subject: [PATCH 04/16] Close #642: macOS MariaDB plugin requires SSL

Add
 - MYSQL_OPT_SSL_ENFORCE
 - MYSQL_OPT_SSL_VERIFY_SERVER_CERT
 - MARIADB_OPT_TLS_PEER_FP
 - MARIADB_OPT_TLS_PEER_FP_LIST

options to control the SSL behavior.

Especially to disable SSL you need to set
MYSQL_OPT_SSL_VERIFY_SERVER_CERT to false on macosx.
---
 doc/rst/database.rst |  7 ++++---
 misc/qsqlmysql.patch | 26 ++++++++++++++++++++++++++
 release/build-mac.sh |  3 +--
 3 files changed, 31 insertions(+), 5 deletions(-)
 create mode 100644 misc/qsqlmysql.patch

diff --git a/doc/rst/database.rst b/doc/rst/database.rst
index 5dc165fe..32fade64 100644
--- a/doc/rst/database.rst
+++ b/doc/rst/database.rst
@@ -80,9 +80,10 @@ Also the environment variable XCA_<driver-name>_OPTIONS may be used to set the o
 
 The file must contain the options as ; separated key=value pairs. The recognized options depend
 on the database driver. See:
-https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS for PostgreSQL and
-https://doc.qt.io/qt-6/sql-driver.html#connection-options for MySQL and
-https://doc.qt.io/qt-6/sql-driver.html#odbc-unicode-support for ODBC.
+
+ - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS for PostgreSQL and
+ - https://doc.qt.io/qt-6/sql-driver.html#connection-options for MySQL and
+ - https://doc.qt.io/qt-6/sql-driver.html#odbc-unicode-support for ODBC.
 
 .. _extracting-items:
 
diff --git a/misc/qsqlmysql.patch b/misc/qsqlmysql.patch
new file mode 100644
index 00000000..abc99cc3
--- /dev/null
+++ b/misc/qsqlmysql.patch
@@ -0,0 +1,26 @@
+diff --git a/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt b/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt
+index fb28abd9..d7a3f2da 100644
+--- a/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt
++++ b/qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt
+@@ -21,4 +21,3 @@ qt_internal_add_plugin(QMYSQLDriverPlugin
+         Qt::SqlPrivate
+ )
+ 
+-qt_internal_force_macos_intel_arch(QMYSQLDriverPlugin)
+diff --git a/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp b/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp
+index 3525c257..84081b22 100644
+--- a/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp
++++ b/qtbase/src/plugins/sqldrivers/mysql/qsql_mysql.cpp
+@@ -1288,6 +1288,12 @@ bool QMYSQLDriver::open(const QString &db,
+ #endif
+ #if defined(MYSQL_VERSION_ID) && MYSQL_VERSION_ID >= 50711 && !defined(MARIADB_VERSION_ID)
+         {"MYSQL_OPT_SSL_MODE"_L1,        MYSQL_OPT_SSL_MODE,        setOptionSslMode},
++#endif
++#if defined(MARIADB_VERSION_ID)
++        {"MYSQL_OPT_SSL_ENFORCE"_L1,     MYSQL_OPT_SSL_ENFORCE,     setOptionBool},
++        {"MYSQL_OPT_SSL_VERIFY_SERVER_CERT"_L1, MYSQL_OPT_SSL_VERIFY_SERVER_CERT,     setOptionBool},
++        {"MARIADB_OPT_TLS_PEER_FP"_L1,   MARIADB_OPT_TLS_PEER_FP,     setOptionString},
++        {"MARIADB_OPT_TLS_PEER_FP_LIST"_L1,     MARIADB_OPT_TLS_PEER_FP_LIST,     setOptionString},
+ #endif
+         {"MYSQL_OPT_CONNECT_TIMEOUT"_L1, MYSQL_OPT_CONNECT_TIMEOUT, setOptionInt},
+         {"MYSQL_OPT_READ_TIMEOUT"_L1,    MYSQL_OPT_READ_TIMEOUT,    setOptionInt},
diff --git a/release/build-mac.sh b/release/build-mac.sh
index 2ee2b241..d790d1b0 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -125,8 +125,7 @@ do_openssl
 #do_zstd
 #do_mariadb_connector_c
 # aqt install-src mac 6.6.3 --archives qtbase
-# qtbase/src/plugins/sqldrivers/mysql/CMakeLists.txt:
-#    -qt_internal_force_macos_intel_arch(QMYSQLDriverPlugin)
+# patch -p1 < $XCA_DIR/misc/qsqlmysql.patch
 do_qsqlmysql
 
 cmake -B "$BUILDDIR" "$XCA_DIR" \

From 70d217b3547db65d89f8759ee61b4d3e00ee31c3 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Sun, 23 Mar 2025 17:41:47 +0100
Subject: [PATCH 05/16] Close #641: Keep serial number & revoke old certificate

should not be used at the same time. Actually "Keep serial number"
should generally be used with care.

When checking "Keep serial number", "Revoke old certificate" is disabled
and unchecked and "Replace old certificate" is disabled and checked.
---
 doc/rst/certificates.rst |  4 ++++
 widgets/CertExtend.cpp   | 19 +++++++++++++++++++
 widgets/CertExtend.h     |  3 +++
 3 files changed, 26 insertions(+)

diff --git a/doc/rst/certificates.rst b/doc/rst/certificates.rst
index b3589716..14791f63 100644
--- a/doc/rst/certificates.rst
+++ b/doc/rst/certificates.rst
@@ -152,6 +152,10 @@ original one with adjusted validity dates.
 Use the *Revoke old certificate* check-box to automatically revoke the old
 certificate.
 
+Be careful with the "Keep serial number" option. A revocation will revoke both
+certificates, because they have the same serial number. It is recommended to
+either replace the old certificate or not use this option at all.
+
 If more than one certificate of the same issuer is selected,
 all of them will be renewed at once with the same validity dates.
 The context menu shows this by adding the number of selected certificates
diff --git a/widgets/CertExtend.cpp b/widgets/CertExtend.cpp
index 75df37ec..44386f3f 100644
--- a/widgets/CertExtend.cpp
+++ b/widgets/CertExtend.cpp
@@ -37,6 +37,25 @@ void CertExtend::on_applyTime_clicked()
 				     validRange->currentIndex());
 }
 
+void CertExtend::on_keepSerial_toggled(bool checked)
+{
+	if (checked) {
+		old_revoke = revoke->isChecked();
+		revoke->setEnabled(false);
+		revoke->setChecked(false);
+
+		old_replace = replace->isChecked();
+		replace->setEnabled(false);
+		replace->setChecked(true);
+	} else {
+		revoke->setEnabled(true);
+		revoke->setChecked(old_revoke);
+
+		replace->setEnabled(true);
+		replace->setChecked(old_replace);
+	}
+}
+
 void CertExtend::accept()
 {
 	if (signer && notBefore->getDate() < signer->getNotBefore()) {
diff --git a/widgets/CertExtend.h b/widgets/CertExtend.h
index 92ca9004..e1317561 100644
--- a/widgets/CertExtend.h
+++ b/widgets/CertExtend.h
@@ -18,12 +18,15 @@ class CertExtend: public QDialog, public Ui::CertExtend
 	Q_OBJECT
 
 	pki_x509 *signer{};
+	bool old_replace{};
+	bool old_revoke{};
 
    public:
 	CertExtend(QWidget *parent, pki_x509 *s);
 
    public slots:
 	void on_applyTime_clicked();
+	void on_keepSerial_toggled(bool);
 	void accept();
 
 };

From 51de716caf6755317d37fae24ff9d24d8087c763 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Sun, 23 Mar 2025 21:33:54 +0100
Subject: [PATCH 06/16] Close #643: secp521r1 ssh fingerprints incorrect

SSH only uses and supports curve "prime256v1".

Only display SSH fingerprints for supported keys.
---
 widgets/KeyDetail.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/widgets/KeyDetail.cpp b/widgets/KeyDetail.cpp
index 2dcae74f..913560b6 100644
--- a/widgets/KeyDetail.cpp
+++ b/widgets/KeyDetail.cpp
@@ -50,9 +50,9 @@ void KeyDetail::setupFingerprints(pki_key *key)
 	v->addWidget(widget);
 	v->addStretch();
 
-	QStringList sl; sl <<
-		"ssh MD5" << "ssh SHA256 B64" <<
-		"x509 SHA1" << "DER SHA256";
+	QStringList sl = { "x509 SHA1", "DER SHA256" };
+	if (key->SSH2_compatible())
+		sl += QStringList({ "ssh MD5", "ssh SHA256 B64" });
 
 	foreach(QString type, sl) {
 		qDebug() << type << key->fingerprint(type);

From 5f4b4dca6f829b6b070cc669fd91e6f7a7c3ffbd Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Mon, 24 Mar 2025 10:23:26 +0100
Subject: [PATCH 07/16] Fix documentation in txt files

and include the "text_header_file.cmake"
into the CMakeLists.txt
---
 cmake/text_header_file.cmake | 19 -------------------
 misc/CMakeLists.txt          | 24 +++++++++++++++++-------
 2 files changed, 17 insertions(+), 26 deletions(-)
 delete mode 100644 cmake/text_header_file.cmake

diff --git a/cmake/text_header_file.cmake b/cmake/text_header_file.cmake
deleted file mode 100644
index c90b4693..00000000
--- a/cmake/text_header_file.cmake
+++ /dev/null
@@ -1,19 +0,0 @@
-
-if (FILE AND SRC AND DST)
-  if (APPLE)
-    set(DIR_HINT "HOME/Library/Application Support/data/xca/${FILE}.txt")
-  elseif (WIN32)
-    set(DIR_HINT "PROFILE\\Application Data\\xca\\${FILE}.txt")
-  else()
-    set(DIR_HINT "/usr/local/share/xca/${FILE}.txt or HOME/.local/share/xca/${FILE}.txt")
-  endif()
-
-  file(READ "${SRC}/preamble.txt" PREAMBLE)
-  file(READ "${SRC}/${FILE}.text" CONT)
-  file(WRITE "${DST}/${FILE}.txt"
-       ${PREAMBLE} "\n# "
-       ${DIR_HINT} "\n"
-       ${CONT})
-else()
-  message(FATAL_ERROR "Mandatory FILE or SRC variable not defined")
-endif()
diff --git a/misc/CMakeLists.txt b/misc/CMakeLists.txt
index aa6af143..8f7b506e 100644
--- a/misc/CMakeLists.txt
+++ b/misc/CMakeLists.txt
@@ -19,15 +19,25 @@ list(TRANSFORM XCA_TEMPLATES PREPEND ${S}/)
 target_sources(${CMAKE_PROJECT_NAME} PRIVATE ${XCA_TEMPLATES})
 list(APPEND APP_RESOURCES "${XCA_TEMPLATES}")
 
-##### Text Files ids.txt eku.txt dn.txt
+##### Text Files oids.txt eku.txt dn.txt
 
 macro(Text_header file)
-    add_custom_command(OUTPUT "${D}/${file}.txt"
-        COMMAND ${CMAKE_COMMAND} -DFILE=${file} -DSRC="${S}" -DDST="${D}"
-        -P "${PROJECT_SOURCE_DIR}/cmake/text_header_file.cmake"
-        DEPENDS "${S}/${file}.text" "${S}/preamble.txt"
-    )
-    list(APPEND TEXT_FILES "${D}/${file}.txt")
+  if (APPLE)
+    set(DIR_HINT "HOME/Library/Application Support/data/de.hohnstaedt.xca/${file}.txt")
+  elseif (WIN32)
+    set(DIR_HINT "PROFILE\\Application Data\\xca\\${file}.txt")
+  else()
+    set(DIR_HINT "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DATADIR}/${file}.txt or \$HOME/.local/share/de.hohnstaedt.xca/${file}.txt")
+  endif()
+
+  file(READ "${S}/preamble.txt" PREAMBLE)
+  file(READ "${S}/${file}.text" CONT)
+  file(WRITE "${D}/${file}.txt"
+       ${PREAMBLE} "\n# "
+       ${DIR_HINT} "\n"
+       ${CONT}
+  )
+  list(APPEND TEXT_FILES "${D}/${file}.txt")
 endmacro()
 
 Text_header(dn)

From 5e972f3a281e04107a72838688581e5f975ed8eb Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Mon, 24 Mar 2025 11:25:34 +0100
Subject: [PATCH 08/16] Update Dockerfile: Ubuntu Noble - QT6

---
 Dockerfile | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7cb66de9..78056694 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 ARG REGISTRY_PREFIX=''
-ARG CODENAME=jammy
+ARG CODENAME=noble
 
 FROM ${REGISTRY_PREFIX}ubuntu:${CODENAME} as builder
 
@@ -9,18 +9,17 @@ RUN set -x \
 	&& apt update \
 	&& apt upgrade -y \
 	&& apt install --yes --no-install-recommends \
-		build-essential libssl-dev pkg-config qtbase5-dev \
-		qttools5-dev-tools qttools5-dev libqt5sql5 libqt5help5 \
-		python3-sphinxcontrib.qthelp git cmake
+		build-essential libssl-dev pkg-config ninja-build \
+		python3-sphinxcontrib.qthelp git cmake locales \
+		qt6-base-dev qt6-tools-dev
 
-ARG PARALLELMFLAGS=-j6
 ARG BUILD_DIR=/tmp/build
 
 COPY . ${BUILD_DIR}
 RUN set -x \
 	&& cd ${BUILD_DIR} \
-	&& cmake -B BUILD \
-	&& cmake --build BUILD ${PARALLELMFLAGS} \
+	&& cmake -B BUILD -G Ninja \
+	&& cmake --build BUILD \
 	&& cmake --install BUILD \
 	&& cd \
 	&& mv ${BUILD_DIR}/misc/docker_start.sh / \

From 5e77d3de5a0cbd723c85e4c45c473ea3d8aab93b Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Mon, 24 Mar 2025 20:42:52 +0100
Subject: [PATCH 09/16] Close #603: xca.exe(portable) without signature

Extend osslsign script to sign everything inside the portable ZIP
---
 release/osslsign.sh | 27 ++++++++++++++++++++++++---
 release/release.txt |  8 ++++++++
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/release/osslsign.sh b/release/osslsign.sh
index 3664a84c..88d65e86 100755
--- a/release/osslsign.sh
+++ b/release/osslsign.sh
@@ -1,6 +1,5 @@
 #!/bin/sh
 
-if test -z "$1"; then echo "usage: $0 <filename>"; exit 1; fi
 
 set -x
 V="${1##*xca-}"
@@ -20,11 +19,33 @@ case "$OSTYPE" in
 esac
 pkcs11_id="9d8aad00d9fa2bc1f104e9744108d4551b53d2b7"
 
-osslsigncode sign \
+do_sign()
+{
+  echo "#### Signing $1"
+  osslsigncode sign \
   -key "$pkcs11_id" -pkcs11cert "$pkcs11_id" \
   -pkcs11engine "$engine" -pkcs11module "$module" \
   -n "XCA ${V}" -i https://hohnstaedt.de/xca \
   -t http://timestamp.comodoca.com -h sha2 \
   -in "${1}" -out "${1}.signed" &&
 
-exec mv "${1}.signed" "${1}"
+  mv "${1}.signed" "${1}"
+}
+
+case "$1" in
+  xca-portable-*.zip)
+    unzip "$1"
+    for file in xca-portable-*/lib*.dll xca-portable-*/xca.exe; do
+      test -f "$file"
+      do_sign "$file"
+    done
+    rm -f "$1"
+    zip "$1" xca-portable-*
+    ;;
+  *.msi|*.exe)
+    do_sign "$1"
+    ;;
+  *)
+    echo "Unexpected file : $1"
+    ;;
+esac
diff --git a/release/release.txt b/release/release.txt
index f9fde31f..c25bb4e7 100644
--- a/release/release.txt
+++ b/release/release.txt
@@ -25,6 +25,14 @@ xcrun notarytool submit "$DMG" --keychain-profile "AC_PASSWORD" --key-id HWR8GSJ
 
 xcrun stapler staple "$DMG"
 
+MS Code signing
+---------------
+Currently only works on MAC....
+
+./release/osslsign.sh xca-portable-*.zip
+./release/osslsign.sh xca-*.msi
+
+
 Microsoft Store
 -----------------
 OpenSSL:

From fbed31eb1cca5103716f4f767dde39c431f5c149 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Tue, 25 Mar 2025 11:52:59 +0100
Subject: [PATCH 10/16] Update libraries

---
 release/build-mac.sh | 6 +++---
 release/build-w64.sh | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/release/build-mac.sh b/release/build-mac.sh
index d790d1b0..81e34e94 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -108,10 +108,10 @@ do_qsqlmysql()
 }
 
 OSSL_MAJOR="3"
-OSSL="openssl-3.3.2"
+OSSL="openssl-3.4.1"
 XCA_DIR="$(cd `dirname $0`/.. && pwd)"
 TOP_DIR="`dirname $XCA_DIR`"
-QT_DIR="$TOP_DIR/6.6.3/macos"
+QT_DIR="$TOP_DIR/6.8.3/macos"
 
 BUILDDIR="$TOP_DIR/osx-release-dmg"
 BUILDDIR_APPSTORE="$TOP_DIR/osx-release-appstore"
@@ -124,7 +124,7 @@ cd $TOP_DIR
 do_openssl
 #do_zstd
 #do_mariadb_connector_c
-# aqt install-src mac 6.6.3 --archives qtbase
+# aqt install-src mac 6.8.3 --archives qtbase
 # patch -p1 < $XCA_DIR/misc/qsqlmysql.patch
 do_qsqlmysql
 
diff --git a/release/build-w64.sh b/release/build-w64.sh
index cf57ff27..c2259942 100644
--- a/release/build-w64.sh
+++ b/release/build-w64.sh
@@ -13,10 +13,10 @@ do_openssl() {
   make install
 }
 
-OSSL="openssl-3.3.2"
+OSSL="openssl-3.4.1"
 XCA_DIR="$(cd `dirname $0`/.. && pwd)"
 TOP_DIR="`dirname $XCA_DIR`"
-QT_DIR="$TOP_DIR/QT/6.8.0/mingw_64"
+QT_DIR="$TOP_DIR/QT/6.8.3/mingw_64"
 BUILDDIR="$TOP_DIR/w64-release"
 INSTALL_DIR="/c/OpenSSL"
 JOBS=7

From 955cc638a0d4b75ab7fa3eae56b23089d4853f6c Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Thu, 27 Mar 2025 08:55:08 +0100
Subject: [PATCH 11/16] Optimize building of zstd

---
 release/build-mac.sh | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/release/build-mac.sh b/release/build-mac.sh
index 81e34e94..ffe24a5f 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -30,22 +30,14 @@ do_zstd()
   ZSTDV=1.5.6
   ARCHIVE=zstd-${ZSTDV}.tar.gz
   test -f $ARCHIVE || curl -L https://github.com/facebook/zstd/archive/refs/tags/v${ZSTDV}.tar.gz -o ${ARCHIVE}
-  for arch in x86_64 arm64; do
-    ZBUILD=zstd-${arch}
-    mkdir -p "$ZBUILD"
-    (cd "$ZBUILD"
-      tar -zxf ../${ARCHIVE} --strip-components 1
-      export CFLAGS="-target ${arch}-apple-macos11 -mmacosx-version-min=$SDK"
-      export PREFIX="$INSTALL_DIR"
-      make -j5 && make install
-    )
-    # DESTDIR="$INSTALL_DIR" make install
-    PARTS_dylib="$PARTS_dylib $ZBUILD/lib/libzstd.dylib"
-    PARTS_a="$PARTS_a $ZBUILD/lib/libzstd.a"
-  done
-  rm -f "$INSTALL_DIR"/lib/libzstd.dylib "$INSTALL_DIR"/lib/libzstd.a
-  lipo -create -output "$INSTALL_DIR"/lib/libzstd.dylib $PARTS_dylib
-  lipo -create -output "$INSTALL_DIR"/lib/libzstd.a $PARTS_a
+  ZBUILD=zstd-$ZSTDV
+  tar -zxf ${ARCHIVE}
+  (cd "$ZBUILD"
+    export CFLAGS="-arch x86_64 -arch arm64 -mmacosx-version-min=$SDK"
+    export PREFIX="$INSTALL_DIR"
+    make -j$JOBS && make install
+    unset CFLAGS PREFIX
+  )
 }
 
 do_mariadb_connector_c()

From ff9d5fcf56b47ccbac88ca57444946af725560b0 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Wed, 26 Mar 2025 13:30:12 +0100
Subject: [PATCH 12/16] Also compile and include PostgreSQL driver

---
 release/build-mac.sh | 40 +++++++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/release/build-mac.sh b/release/build-mac.sh
index ffe24a5f..16a68956 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -60,19 +60,31 @@ do_mariadb_connector_c()
   cmake --install ${B} --prefix="$INSTALL_DIR"
 }
 
+do_postgres()
+{
+  PGV=17.4
+  ARCHIVE=postgresql-$PGV.tar.gz
+  test -f $ARCHIVE || curl -L https://ftp.postgresql.org/pub/source/v$PGV/$ARCHIVE -O
+  tar -zxf ${ARCHIVE}
+  (cd postgresql-$PGV
+    CFLAGS="-arch x86_64 -arch arm64 -mmacosx-version-min=$SDK" \
+    ./configure --with-ssl=openssl --without-icu --prefix="${INSTALL_DIR}" \
+       --with-includes="$INSTALL_DIR"/include --with-libraries="$INSTALL_DIR"/lib
+    make -j$JOBS && make install
+  )
+}
+
 # need to install ninja via "brew install ninja"
-do_qsqlmysql()
+do_qsql()
 {
   PLUGIN="$QT_DIR/plugins/sqldrivers/libqsqlmysql.dylib"
 #  test -f "$PLUGIN" && return
   SQL_BUILD="$TOP_DIR/build-sqlplugins"
   ( cd "$QT_DIR/../Src/qtbase"
-    ./configure -cmake-generator Ninja -release -no-feature-x86intrin -sql-mysql \
+    ./configure -cmake-generator Ninja -release -no-feature-x86intrin -sql-mysql -sql-psql \
 	CMAKE_BUILD_TYPE=Release \
 	CMAKE_PREFIX_PATH="$INSTALL_DIR" \
 	CMAKE_OSX_DEPLOYMENT_TARGET=$SDK \
-	DMySQL_ROOT="$INSTALL_DIR" \
-	FEATURE_sql_odbc=OFF FEATURE_sql_sqlite=OFF
   )
 
   rm -rf "$SQL_BUILD"
@@ -83,9 +95,11 @@ do_qsqlmysql()
 	-DCMAKE_INSTALL_PREFIX="$QT_DIR" \
 	-DCMAKE_OSX_DEPLOYMENT_TARGET=$SDK \
 	-DMySQL_ROOT="$INSTALL_DIR" \
+	-DPostgreSQL_ROOT="$INSTALL_DIR" \
+	-DFEATURE_sql_odbc=OFF -DFEATURE_sql_sqlite=OFF \
 	"$QT_DIR/../Src/qtbase/src/plugins/sqldrivers"
 
-  cmake --build $SQL_BUILD -j$JOBS -v
+  cmake --build $SQL_BUILD -j$JOBS
   cmake --install $SQL_BUILD
   # Replace @rpath name by full path in the installed file,
   # to trigger macdeployqt to pick up this library.
@@ -116,9 +130,10 @@ cd $TOP_DIR
 do_openssl
 #do_zstd
 #do_mariadb_connector_c
+#do_postgres
 # aqt install-src mac 6.8.3 --archives qtbase
 # patch -p1 < $XCA_DIR/misc/qsqlmysql.patch
-do_qsqlmysql
+do_qsql
 
 cmake -B "$BUILDDIR" "$XCA_DIR" \
 	-DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" \
@@ -128,12 +143,6 @@ cmake -B "$BUILDDIR" "$XCA_DIR" \
 
 cmake --build "$BUILDDIR" -j$JOBS
 
-if test -d /Applications/Postgres.app; then
-	echo "###### Hey Christian, rename /Applications/Postgres.app when linking, to skip those drivers !!"
-	# If the Postgres.app exists, macdeployqt will take that libpg.dylib and
-	# install it inside XCA. This destroys other links to libssl-1.1 ...
-	# Let the users install /Applications/Postgres.app
-fi
 (cd "$BUILDDIR" && cpack)
 
 ######## Create the AppStore Package
@@ -150,4 +159,9 @@ cmake --build "$BUILDDIR_APPSTORE" -j$JOBS
 productbuild --component "$BUILDDIR_APPSTORE/xca.app" /Applications \
     --sign "3rd Party Mac Developer Installer" "$BUILDDIR_APPSTORE/xca-${xca_version}-appstore.pkg"
 
-find "${BUILDDIR_APPSTORE}/xca.app" "${BUILDDIR}/xca.app" -name "*.dylib" | xargs otool -L | grep -E "/Applications/\|$HOME"
+if find "${BUILDDIR_APPSTORE}/xca.app" "${BUILDDIR}/xca.app" -name "*.dylib" | xargs otool -L | grep -e "/Applications/\|\t$HOME"
+then
+  echo
+  echo "Error: some libraries are linked to /Applications or $HOME"
+  exit 1
+fi

From d2a02b72969af813e84fc0c10607a85902884053 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Thu, 27 Mar 2025 22:37:11 +0100
Subject: [PATCH 13/16] Python 3.13 did not work ...

pip install aqtinstall failed, because it wanted to compile
a dependency...
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index cf81634a..3755e39d 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ XCA can be used with Xcode after initializing the directory with:
 ### Windows
 
 - Install the dependencies
-  - Install Python for windows from the store or https://www.python.org/downloads/windows/
+  - Install Python 3.11 for windows from the store or https://www.python.org/downloads/windows/
   - Install OpenSSL from here: https://slproweb.com/download/Win64OpenSSL-3_1_5.msi and verify the sha256 from https://github.com/slproweb/opensslhashes/blob/master/win32_openssl_hashes.json
   - To install the Qt libraries, cmake and the MinGW compiler [aqtinstall](https://github.com/miurahr/aqtinstall) is used.
     Sphinx is used to generate the documentation

From 035663ce3f8758b4efa77fdf2ea8ff83e55a1af2 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Thu, 27 Mar 2025 22:33:01 +0100
Subject: [PATCH 14/16] Windows build script: local installation of openssl

---
 release/build-w64.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/release/build-w64.sh b/release/build-w64.sh
index c2259942..d34044e9 100644
--- a/release/build-w64.sh
+++ b/release/build-w64.sh
@@ -1,6 +1,7 @@
 #!/bin/sh
 
 # in C:\msys64\msys2.ini: MSYS2_PATH_TYPE=inherit
+# pacman -S vim make zip
 
 # Build xca on Windows 
 do_openssl() {
@@ -16,16 +17,15 @@ do_openssl() {
 OSSL="openssl-3.4.1"
 XCA_DIR="$(cd `dirname $0`/.. && pwd)"
 TOP_DIR="`dirname $XCA_DIR`"
-QT_DIR="$TOP_DIR/QT/6.8.3/mingw_64"
 BUILDDIR="$TOP_DIR/w64-release"
-INSTALL_DIR="/c/OpenSSL"
+INSTALL_DIR="$TOP_DIR/OpenSSL"
 JOBS=7
 
 cd $TOP_DIR
 do_openssl
 
 cd $TOP_DIR
-cmake -B "$BUILDDIR" -G "MinGW Makefiles" -DCMAKE_PREFIX_PATH="$QT_DIR:$INSTALL_DIR" $XCA_DIR
-cmake --build "$BUILDDIR" -j5
+cmake -B "$BUILDDIR" -G "MinGW Makefiles" -DCMAKE_PREFIX_PATH="$INSTALL_DIR" $XCA_DIR
+cmake --build "$BUILDDIR" -j$JOBS
 cmake --build "$BUILDDIR" -t install
 cd "$BUILDDIR" && cpack

From 4b29d5f31eeeae51d61e5a40fcff3e879210a879 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Fri, 28 Mar 2025 09:54:04 +0100
Subject: [PATCH 15/16] Mac OS: apply the qsqlmysql patch automatically

---
 release/build-mac.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/release/build-mac.sh b/release/build-mac.sh
index 16a68956..a9b2d236 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -97,7 +97,7 @@ do_qsql()
 	-DMySQL_ROOT="$INSTALL_DIR" \
 	-DPostgreSQL_ROOT="$INSTALL_DIR" \
 	-DFEATURE_sql_odbc=OFF -DFEATURE_sql_sqlite=OFF \
-	"$QT_DIR/../Src/qtbase/src/plugins/sqldrivers"
+	"$QT_SQL_SRC"
 
   cmake --build $SQL_BUILD -j$JOBS
   cmake --install $SQL_BUILD
@@ -118,6 +118,7 @@ OSSL="openssl-3.4.1"
 XCA_DIR="$(cd `dirname $0`/.. && pwd)"
 TOP_DIR="`dirname $XCA_DIR`"
 QT_DIR="$TOP_DIR/6.8.3/macos"
+QT_SQL_SRC="$QT_DIR/../Src/qtbase/src/plugins/sqldrivers"
 
 BUILDDIR="$TOP_DIR/osx-release-dmg"
 BUILDDIR_APPSTORE="$TOP_DIR/osx-release-appstore"
@@ -132,7 +133,10 @@ do_openssl
 #do_mariadb_connector_c
 #do_postgres
 # aqt install-src mac 6.8.3 --archives qtbase
-# patch -p1 < $XCA_DIR/misc/qsqlmysql.patch
+if grep qt_internal_force_macos_intel_arch $QT_SQL_SRC/mysql/CMakeLists.txt; then
+  (cd $QT_SQL_SRC && patch -p5 < $XCA_DIR/misc/qsqlmysql.patch)
+fi
+
 do_qsql
 
 cmake -B "$BUILDDIR" "$XCA_DIR" \

From e64d2bebb0827ba6c78235f99bd67dd60a8191ab Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Fri, 28 Mar 2025 10:46:29 +0100
Subject: [PATCH 16/16] Update changelog

---
 changelog | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/changelog b/changelog
index de2e8701..3093899c 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,12 @@
+ * Add PostgreSQL driver to Mac OSX
+ * Update libraies: OpenSSL 3.4.1, QT 6.8.3
+ * Close #603: xca.exe(portable) without signature
+ * Close #643: secp521r1 ssh fingerprints incorrect
+ * Close #641: Keep serial number & revoke old certificate
+ * Close #642: macOS MariaDB plugin requires SSL
+ * Close #640: Fix mysql on Mac OSX
+ * Close #602: Linux/Flatpak: default template TLS_server is missing
+
 xca 2.8.0 Sun Oct 13 2024
 -------------------------