From ff2df288489bf3706e01da44dd772bbde82d117f Mon Sep 17 00:00:00 2001
From: Julius Pfrommer <julius.pfrommer@o6-automation.com>
Date: Sat, 17 Oct 2026 23:54:26 +0200
Subject: [PATCH] ci: fix PR security build and SKS test failures

---
 plugins/crypto/openssl/certificategroup.c      | 5 +++--
 tests/pubsub/check_pubsub_sks_securitygroups.c | 4 ++++
 tools/ci/linux/ci.sh                           | 2 +-
 tools/ci/win/build_mingw.sh                    | 2 +-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/plugins/crypto/openssl/certificategroup.c b/plugins/crypto/openssl/certificategroup.c
index b45e0fe9f..0a32c5ac9 100644
--- a/plugins/crypto/openssl/certificategroup.c
+++ b/plugins/crypto/openssl/certificategroup.c
@@ -759,14 +759,15 @@ UA_CertificateUtils_verifyApplicationUri(const UA_ByteString *certificate,
     for(int i = 0; i < sk_GENERAL_NAME_num(pNames); i++) {
         GENERAL_NAME *value = sk_GENERAL_NAME_value(pNames, i);
         if(value->type == GEN_URI) {
-            subjectURI.length = (size_t) (value->d.ia5->length);
+            subjectURI.length = (size_t)ASN1_STRING_length(value->d.ia5);
             subjectURI.data = (UA_Byte*)UA_malloc(subjectURI.length);
             if(!subjectURI.data) {
                 X509_free(certificateX509);
                 sk_GENERAL_NAME_pop_free(pNames, GENERAL_NAME_free);
                 return UA_STATUSCODE_BADSECURITYCHECKSFAILED;
             }
-            (void)memcpy(subjectURI.data, value->d.ia5->data, subjectURI.length);
+            (void)memcpy(subjectURI.data, ASN1_STRING_get0_data(value->d.ia5),
+                         subjectURI.length);
             break;
         }
     }
diff --git a/tests/pubsub/check_pubsub_sks_securitygroups.c b/tests/pubsub/check_pubsub_sks_securitygroups.c
index 330b900dc..ad7dcc2d1 100644
--- a/tests/pubsub/check_pubsub_sks_securitygroups.c
+++ b/tests/pubsub/check_pubsub_sks_securitygroups.c
@@ -451,7 +451,11 @@ START_TEST(GetSecurityKeysAllocatesByteStringArray) {
         0, UA_NS0ID_PUBLISHSUBSCRIBE_GETSECURITYKEYS);
     request.inputArgumentsSize = 3;
     request.inputArguments = getInput;
+    /* This test exercises allocation, so give the admin Session a user ID
+     * to pass the GetSecurityKeys access check. */
+    server->adminSession.clientUserIdOfSession = UA_STRING("testuser");
     UA_CallMethodResult result = UA_Server_call(server, &request);
+    server->adminSession.clientUserIdOfSession = UA_STRING_NULL;
     server->adminSession.channel = NULL;
     UA_SecureChannel_clear(&channel);
 
diff --git a/tools/ci/linux/ci.sh b/tools/ci/linux/ci.sh
index 88d2da40a..6a8dff434 100644
--- a/tools/ci/linux/ci.sh
+++ b/tools/ci/linux/ci.sh
@@ -166,7 +166,7 @@ EOF
 
     x86_64-w64-mingw32-gcc -D_WIN32_WINNT=0x0600 \
         -Wall -Werror amalgamation_none_smoke.c open62541.c \
-        -o amalgamation_none_smoke.exe -lws2_32 -liphlpapi
+        -o amalgamation_none_smoke.exe -lws2_32 -liphlpapi -lbcrypt
 }
 
 function build_amalgamation_mt {
diff --git a/tools/ci/win/build_mingw.sh b/tools/ci/win/build_mingw.sh
index 16d36ceeb..2e605960c 100644
--- a/tools/ci/win/build_mingw.sh
+++ b/tools/ci/win/build_mingw.sh
@@ -59,7 +59,7 @@ int main(void) {
 }
 EOF
 
-${CC:-gcc} -I. amalgamation_none_smoke.c open62541.c -o amalgamation_none_smoke.exe -lws2_32 -liphlpapi
+${CC:-gcc} -I. amalgamation_none_smoke.c open62541.c -o amalgamation_none_smoke.exe -lws2_32 -liphlpapi -lbcrypt
 
 rm -r *