Commit 2336a1f0050 for nodejs

commit 2336a1f005009aa8e9832eaf3b520fa9bc11fecb
Author: Filip Skokan <panva.ip@gmail.com>
Date:   Wed Nov 4 10:52:15 2026 +0100

    crypto: make X.509 inspection guards explicit

    Require a supported backend when selecting the BIT STRING length
    capability. Reject other backends at compile time, matching the
    surrounding checks used to catch unsupported OpenSSL backports.

    Assisted-by: Codex
    Signed-off-by: Filip Skokan <panva.ip@gmail.com>
    PR-URL: https://github.com/nodejs/node/pull/67245
    Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 97e0945eca0..6e38add4a8b 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -64,10 +64,12 @@
 // OpenSSL 4 makes ASN1_STRING opaque and provides a checked BIT STRING length
 // accessor. Earlier OpenSSL releases and pinned BoringSSL expose the decoded
 // unused-bit count through ASN1_STRING::flags.
-#if !NCRYPTO_USE_BORINGSSL && OPENSSL_VERSION_PREREQ(4, 0)
+#if NCRYPTO_USE_OPENSSL_PROVIDER && OPENSSL_VERSION_PREREQ(4, 0)
 #define NCRYPTO_HAS_ASN1_BIT_STRING_GET_LENGTH 1
-#else
+#elif NCRYPTO_USE_OPENSSL_PROVIDER || NCRYPTO_USE_BORINGSSL
 #define NCRYPTO_HAS_ASN1_BIT_STRING_GET_LENGTH 0
+#else
+#error "Unsupported crypto backend"
 #endif

 // BoringSSL's X.509 signer can encode only its restricted RSA-PSS parameter