From fefc111a2a0070aa51fd59b7e9db652098ee5c06 Mon Sep 17 00:00:00 2001
From: Ben Laurie <ben@openssl.org>
Date: Tue, 11 Dec 2012 16:05:14 +0000
Subject: [PATCH] Make openssl verify return errors.

---
 CHANGES       |  4 ++++
 Makefile.org  |  2 +-
 apps/verify.c | 16 ++++++++++++----
 test/Makefile |  2 +-
 4 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/CHANGES b/CHANGES
index 1a6e80b80d..2178885cd3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,10 @@
  _______________
 
  Changes between 1.0.x and 1.1.0  [xx XXX xxxx]
+
+  *) Make openssl verify return errors.
+     [Chris Palmer <palmer@google.com> and Ben Laurie]
+
   *) Fix OCSP checking.
      [Rob Stradling <rob.stradling@comodo.com> and Ben Laurie]
 
diff --git a/Makefile.org b/Makefile.org
index e8e235ddc1..428cbbb983 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -540,7 +540,7 @@ rehash.time: certs apps
 		[ -x "apps/openssl.exe" ] && OPENSSL="apps/openssl.exe" || :; \
 		OPENSSL_DEBUG_MEMORY=on; \
 		export OPENSSL OPENSSL_DEBUG_MEMORY; \
-		$(PERL) tools/c_rehash certs) && \
+		$(PERL) tools/c_rehash certs/demo) && \
 		touch rehash.time; \
 	else :; fi
 
diff --git a/apps/verify.c b/apps/verify.c
index bcca114efe..b03085bf87 100644
--- a/apps/verify.c
+++ b/apps/verify.c
@@ -228,11 +228,19 @@ int MAIN(int argc, char **argv)
 	if (crl_download)
 		store_setup_crl_download(cert_ctx);
 
-	if (argc < 1) check(cert_ctx, NULL, untrusted, trusted, crls, e);
+	ret=0;
+	if (argc < 1)
+		{ 
+		if (1 != check(cert_ctx, NULL, untrusted, trusted, crls, e))
+			ret=-1;
+		}
 	else
+		{
 		for (i=0; i<argc; i++)
-			check(cert_ctx,argv[i], untrusted, trusted, crls, e);
-	ret=0;
+			if (1 != check(cert_ctx,argv[i], untrusted, trusted, crls, e))
+				ret=-1;
+		}
+
 end:
 	if (ret == 1) {
 		BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check]");
@@ -267,7 +275,7 @@ end:
 	sk_X509_pop_free(trusted, X509_free);
 	sk_X509_CRL_pop_free(crls, X509_CRL_free);
 	apps_shutdown();
-	OPENSSL_EXIT(ret);
+	OPENSSL_EXIT(ret < 0 ? 2 : ret);
 	}
 
 static int check(X509_STORE *ctx, char *file,
diff --git a/test/Makefile b/test/Makefile
index b919533b37..93619504ff 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -294,7 +294,7 @@ test_ecdh:
 test_verify:
 	@echo "The following command should have some OK's and some failures"
 	@echo "There are definitly a few expired certificates"
-	../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs ../certs/*.pem
+	../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs/demo ../certs/demo/*.pem
 
 test_dh:
 	@echo "Generate a set of DH parameters"
-- 
2.25.1