)]}' { "log": [ { "commit": "5ee9407bc28dd9086507f02851886a185088f3a0", "tree": "a60c7739848dd273e0324c6cb8fb2f102707cc1d", "parents": [ "e0d763c0a49764ce75df710741d6f90a23d584ca" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed May 20 00:59:25 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 20 23:19:15 2026 -0700" }, "message": "Fix off-by-one allowing an unauthenticated handshake abort.\n\nNot considering a vulnerability as any attacker who can do this can just\nas well inject ICMP Destination Unreachable or even just UDP flood the\nclient. Having said that, definitely an interesting bug.\n\nChange-Id: I7608b38a26abcb41ffccaab453990c066a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95587\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "e0d763c0a49764ce75df710741d6f90a23d584ca", "tree": "29a9c4442f4c55d087cd3d957369fbef31481280", "parents": [ "2d8ef80d4d9a2f5a09bd03a17c66fdd706c3f89e" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed May 20 04:55:29 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 20 23:19:12 2026 -0700" }, "message": "bio_read_all: bail out on every error.\n\nOtherwise, trying to read from an uninitialized BIO will underflow due\nto -2 being used as return value to indicate that.\n\nNote that the only way to trigger this function is using the public\nBIO_read_asn1 API; however, it does a bio_read_full first, which makes\nit hard to actually have this condition happen. The BIO would basically\nhave to succeed at first, and suddenly return -2 later. None of the\nbuilt-in BIOs in BoringSSL can do that.\n\nChange-Id: I38777688490ea6cc2d9af23def2beadd6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95628\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "2d8ef80d4d9a2f5a09bd03a17c66fdd706c3f89e", "tree": "f45e75f1f74cba63a83a192691545bc9813f1a52", "parents": [ "c2c9f2f3e5c5d57d0186b14ce2463f9c4a8f8cde" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed May 20 03:21:01 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 20 08:05:27 2026 -0700" }, "message": "RSA: handle gracefully when a SSL_PRIVATE_KEY_METHOD has NULL methods.\n\nInstead of UB, this now returns an error.\n\nThis makes sense, given these can both sign and decrypt, but there are\nconceivable applications where only one is necessary.\n\nChange-Id: Idec6c00d17594aa604170b978370be396a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95607\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "c2c9f2f3e5c5d57d0186b14ce2463f9c4a8f8cde", "tree": "d6e583d0352acb8b38e5ffb964214636e7d1f8b4", "parents": [ "3fff7111b0eca817466e121059cb4e8b67ade35b" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue May 19 04:01:27 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 20 00:38:41 2026 -0700" }, "message": "X509_VERIFY_PARAM_inherit/_set1: refuse if either params are poisoned.\n\nBefore, these functions would unconditionally copy the src\u0027s poison flag\nto the dst, potentially resulting in an unpoisoned context even if the\nreason for poisoning (e.g. a field with invalid value) remains.\n\nAfter this change, copying always fails if any of the two params is\npoisoned.\n\nThe most relevant code path for this is when `X509_STORE_CTX_init` is\ncalled with a poisoned `X509_STORE`; it happily copied the poisoned\ncontext and then cleared the poison flag while inheriting from defaults.\n\nYes, instead the calls in `X509_STORE_CTX_init` could be reversed to\nfirst `inherit` from the defaults and then to `set1` from the user\nprovided context, which then would yield the correct copied poison flag;\nhowever it seems prudent to instead harden the public APIs, as there\ncould be more issues of this kind.\n\nNot considering a vulnerability as the poison flag can only ever be set\non a call to us if a caller used an API wrong by ignoring its return\nvalue. Of course, the whole purpose of the flag is to detect and fail\nsuch callers so no damage happens.\n\nChange-Id: Iaed97dfa21863c882a0d46b1b8439ec06a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95527\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "3fff7111b0eca817466e121059cb4e8b67ade35b", "tree": "6dc8dede1be031728d91eb20b3dc46b431593680", "parents": [ "28d501c2067e2783121fafa48f5eecb52558c79e" ], "author": { "name": "Adam Langley", "email": "agl@imperialviolet.org", "time": "Tue May 19 15:31:14 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 19 09:06:43 2026 -0700" }, "message": "RSA_generate_key_ex: tighten up code a bit.\n\nChange-Id: I2301ea3ce75292bcd4f0e943c916973fb543fdc3\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95567\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "28d501c2067e2783121fafa48f5eecb52558c79e", "tree": "a0dbb12b88b853d03c46768da62a162637d7907a", "parents": [ "beddb582d9e8786a07d79f1cf054d4792b3dd81f" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue May 19 06:45:51 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 19 08:24:46 2026 -0700" }, "message": "RSA_generate_key_ex: reject invalid values of e.\n\nPreviously, invalid values of e made the function loop forever.\n\nChange-Id: I3d03e4b096f988ebb01b378e52d7dab66a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95548\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "beddb582d9e8786a07d79f1cf054d4792b3dd81f", "tree": "a2428d64aa684c99e9eb00785a9cc72dfb51d558", "parents": [ "b6c3c1c6bfc4f8ffceeea3612334909b70187f0e" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Fri May 15 17:05:00 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 15 15:20:32 2026 -0700" }, "message": "Expand on infra/config/README.md a bit\n\nChange-Id: I8ef307afb93a7abb18dc0e6b41a8544c146e29a0\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95447\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "b6c3c1c6bfc4f8ffceeea3612334909b70187f0e", "tree": "9b49a260f12eaf261a558809fc96620baf2fb750", "parents": [ "74ca779f23f56ac387f6905c1a8a20c9ecfbea22" ], "author": { "name": "Hubert Chao", "email": "hchao@chromium.org", "time": "Fri May 15 15:32:39 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 15 12:54:20 2026 -0700" }, "message": "[Server Padding] Don\u0027t pad on resumption handshake.\n\nResumption handshakes don\u0027t pass back certificates, so servers shouldn\u0027t\nsend back padding in these circumstances.\n\nChange-Id: I88f2a27cb9c15927a52c529f83fc60846cf5db04\nBug: 509499093\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95427\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "74ca779f23f56ac387f6905c1a8a20c9ecfbea22", "tree": "c0ce84c8cf37f54625b57194c56a80435c75c9f7", "parents": [ "e8404c8a99f90a74f289aa7897dfb34df9fec293" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 15 13:19:15 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 15 11:07:04 2026 -0700" }, "message": "build: Do not list .inc as compile unit\n\nThey belong to internal headers actually.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I7b65b9145804c8775acdaa6da3e99da86a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95387\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "e8404c8a99f90a74f289aa7897dfb34df9fec293", "tree": "a22c23d625329ab7bf64790172019a059886add4", "parents": [ "47c0f1f0d13b895158a3afbe05b26cf8798258cd" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri May 15 06:30:56 2026 -0700" }, "committer": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri May 15 06:51:21 2026 -0700" }, "message": "Revert \"CI/CQ: in debug builds, enable lots of libc++ checks.\"\n\nIt does not actually check out the libcxx.\n\nThis reverts commit 47c0f1f0d13b895158a3afbe05b26cf8798258cd.\n\nNOPRESUBMIT: The CL I am reverting is what broke CI - this CL will restore it.\nChange-Id: Iecedc686f3e2ef4b5830c5ed2ff43e166a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95407\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "47c0f1f0d13b895158a3afbe05b26cf8798258cd", "tree": "4052d655e08d0c35441ee24d53460c3ce02d8e87", "parents": [ "7fef640699de939dec3685475b21bce866b7e58d" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri May 15 00:34:57 2026 -0700" }, "committer": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri May 15 05:22:25 2026 -0700" }, "message": "CI/CQ: in debug builds, enable lots of libc++ checks.\n\nThis enables making std::sort randomize its order of equal-comparing\nelements, and bounded iterators and unique_ptr (which are, however,\nunlikely to affect BoringSSL right now).\n\nThe goal is that if any order-dependent behaviour exists, unit tests\nshould catch it at a high chance on CI/CQ.\n\nChange-Id: I31624f13068b92590337649c13b8698b6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95367\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "7fef640699de939dec3685475b21bce866b7e58d", "tree": "a22c23d625329ab7bf64790172019a059886add4", "parents": [ "b008298294418d67c1114c8b5f168a0368ecfc96" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon May 11 02:33:36 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 15 02:39:20 2026 -0700" }, "message": "Minor optimizations to ML-DSA: marking some internal functions inline.\n\nThis is the same as 877c3cd5e0f1842a278809ef0f37e9a41492c366 and saves\nabout 6% on an Intel Xeon Gold 6140, and is neutral on AMD EPYC 7B13 and\nApple M1 Pro.\n\nChange-Id: I580a74b9aeb71fb9a93312a7d2111e176a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95147\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "b008298294418d67c1114c8b5f168a0368ecfc96", "tree": "0591117dd651a593c26e522956991e18ecdce327", "parents": [ "db1bdbca1da02e1c033c8fe97b43f498ff567028" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu May 14 13:14:33 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 14 12:03:49 2026 -0700" }, "message": "Switch STACK_OF(T) back to std::sort from std::stable_sort\n\nhttps://boringssl-review.googlesource.com/c/boringssl/+/91687 switched\nSTACK_OF(T)\u0027s sorting to a stable sort after a recently-added test\nexhibited some bugs depending on the sort order.\n\nWhat was actually going on was that the test made some incorrect\nassumptions on how X509_STORE behaved surrounding AKIDs, etc.\nhttps://boringssl-review.googlesource.com/c/boringssl/+/91787 fixed the\ntest to be less sensitive to this.\n\nstd::stable_sort is more likely to allocate and thus depend on the C++\nruntime. We do want to allow the C++ runtime in libcrypto, but there are\nsome hurdles to clear on Android first, so switch back to std::sort.\n(At a glance through output on godbolt, libc++\u0027s std::sort might\nactually be header-only!)\n\nThis does mean that, with the wrong sort order,\nX509StoreGet1IssuerMultipleMatches might test against the wrong\nbaseline. To prevent an unlikely false positive, remove the baselining\ncheck. With the baseline check removed, the test will never have a false\npositive, but we might have a false negative. I.e. we might fail to flag\na bug when it should. However, given the number of name collisions we\nput in there, and the number of different platforms and STLs we test\nagainst, this is unlikely. (Also that code should be rewritten to use a\nhash table anyway.)\n\nChange-Id: I1cca217ac713dbe7758fd4c102d901fdb6ebe177\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95327\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "db1bdbca1da02e1c033c8fe97b43f498ff567028", "tree": "eb0d1402d66f94ef971c939888a74ec915dfd87a", "parents": [ "bb47b7eb72fe3b1e1440b4e272cbe42fb4103403" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed May 13 23:38:29 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 14 09:56:40 2026 -0700" }, "message": "Use the certificate issuer in CMS/PKCS7 signer IDs\n\nWe were using the subject and not noticing because all our tests test\nwith self-signed certificates.\n\nChange-Id: I16774442c463a50030547fc57f078bc387cf643e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95287\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "bb47b7eb72fe3b1e1440b4e272cbe42fb4103403", "tree": "0907cf2c0528482961723cbbc4cc7193a77df0fc", "parents": [ "f928215954536205fdae395ace4c9d671eef089a" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu May 14 15:39:57 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 14 09:55:30 2026 -0700" }, "message": "rust: bssl-macros: Do not depend on std\n\n\nThis is a macros-only crate, obviously we do not need `libstd`.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I80ba7537b79f5fccc799062b1c14bc176a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95307\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "f928215954536205fdae395ace4c9d671eef089a", "tree": "2b064f11aef33cd3522f968c3e64353017206502", "parents": [ "a7481f34712bc056a47ab91015536166b3a6cebb" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 13 10:44:40 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 14 07:54:36 2026 -0700" }, "message": "crypto/evp: Eliminate `operator delete` from EVP_PKEY_CTX destructor\n\nIt turns out that our virtual destructor implicitly depends on the said\nSTL symbol.\nLet us remove this dependency link.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I04d88a9e123a19889c6334cec99494256a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95247\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "a7481f34712bc056a47ab91015536166b3a6cebb", "tree": "2f12f606ec7e63392fbcbd274291144c309436ab", "parents": [ "b12ddd7ab155d73a1fd20daf5ce82a106d06b785" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed May 13 11:17:38 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 13 09:12:31 2026 -0700" }, "message": "Correctly handle max_early_data_size over 2^16\n\nAlthough we never set a max early data size greater than 2^16, the\nprotocol allows it, so we need to track 32 bits worth of early data\nwritten, not 16. (With the size increase, move the field with other\n4-byte-aligned values to make better use of struct padding.)\n\nThe practical impact of this is minor. If a server sent a 0-RTT ticket\nthat allowed \u003e 65K of early data, and if somehow we managed to send that\nmuch data before getting the ServerHello, we might exceed the server\u0027s\nlimit. The server would then reject the connection.\n\nChange-Id: Iee6f562555c062a0b3ded73b98027c3a13609e45\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95267\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "b12ddd7ab155d73a1fd20daf5ce82a106d06b785", "tree": "f9ac5e51a0a27156e50ca409cc22281e076facf7", "parents": [ "d03dbc3e5d7de44183ff17018af22323af650fbc" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Apr 08 15:10:05 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 13 08:53:33 2026 -0700" }, "message": "Alert on ClientHello with only one of key_share and supported_groups\n\nRFC 8446 section 9.2 states that a ClientHello supporting TLS 1.3 must\nalways contain both or neither of \"key_share\" and \"supported_groups\",\nand a violation should result in a \"missing extension\" alert.\n\nPreviously a ClientHello that violated this would fail to negotiate a\ngroup and result in a \"handshake failure\" alert. This CL aligns with the\nspec to send a \"missing extension\" alert instead.\n\nUpdate-Note: This CL changes the value of the TLS alert sent by the\nserver when receiving a TLS 1.3 ClientHello erroneously containing only\none of the key_share and supported_groups extensions. It does not alter\nthe success or failure of the handshake.\n\nBug: 500638473\nChange-Id: Iebaddc73bdd3a4f2eaf464119fdae8906a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95168\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "d03dbc3e5d7de44183ff17018af22323af650fbc", "tree": "3d1f991bafdb38014ffc48729b743b5e0477350b", "parents": [ "4de3f862d93359db223129dc26b735bdaae53238" ], "author": { "name": "James Buckland", "email": "jbuckland@google.com", "time": "Tue May 12 13:43:22 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 12 14:04:15 2026 -0700" }, "message": "Introduce SSL_get_signature_algorithm_used.\n\nChange-Id: Ifed5f5ef022a8c0d6bd57d196f9b4c308ca4f213\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95087\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: James Buckland \u003cjbuckland@google.com\u003e\n" }, { "commit": "4de3f862d93359db223129dc26b735bdaae53238", "tree": "d640514c7a9f6a4838833e44e00e9e68343bdc9b", "parents": [ "3c6ffab1743dc0d1f1d43f91e6084be627ca1995" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed May 06 04:06:05 2026 -0700" }, "committer": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue May 12 11:21:02 2026 -0700" }, "message": "TRUST_TOKEN: remove metadata_key.\n\nIt does nothing.\n\nChange-Id: I9e4bcb3ef8db27af4de7b2dd6062dc526a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94908\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "3c6ffab1743dc0d1f1d43f91e6084be627ca1995", "tree": "25ecadc5eae1975272c303cada020d7213b2bfb9", "parents": [ "11be7d500143b3eebac1641ae892d24ba36f2626" ], "author": { "name": "Hubert Chao", "email": "hchao@chromium.org", "time": "Tue May 12 15:52:09 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 12 09:10:34 2026 -0700" }, "message": "Server Padding Extension\n\nAdd support for a Server Padding Extension. This extension lets clients\nrequest an additional amount of padding from servers, that servers can\nopt into sending back as zeroed out bytes. The maximum number of bytes\nthat a server will send back is 16k.\n\nServers can opt to not send any padding. The client will be able to tell\nif the server sent back the requested amount of padding, and will throw\nan error if padding is sent but not of the requested amount.\n\nThis extension is only supported for TLS 1.3 connections.\n\nThis extension is temporary, and may be removed at any time.\n\nChange-Id: I52713dfbca24dd2e2763be0e88aa424d1c417cd3\nBug: 509499093\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94527\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "11be7d500143b3eebac1641ae892d24ba36f2626", "tree": "17aaffa9b21814f6dc1ecd76e5f7cb42473489ef", "parents": [ "9e04aed2d1652441d2c84e85ed21acc05e053260" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon May 11 20:20:24 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 12 09:07:02 2026 -0700" }, "message": "Add a document explaining what a \"named group\" is\n\nOriginal internal version at go/what-is-a-tls-named-group\n\nChange-Id: I21ebf52150971b91d1822c705c1afbb86123c01c\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95227\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "9e04aed2d1652441d2c84e85ed21acc05e053260", "tree": "a3046cebdd4985398f9ea6b1edf9a74cce0d1bd9", "parents": [ "cad2630ed04f41e645c8791210df59c7d8d19e00" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Sep 18 17:05:51 2025 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 12 07:23:57 2026 -0700" }, "message": "Add SSL_CTX_set1_available_trust_anchors\n\nWe currently derive the available trust anchor list from the credential\nlist. In some cases, the caller might have pre-filtered the credential\nlist by trust anchor already. In that case, we might need their help to\ncorrectly advertise the available options.\n\nFixed: 501170997\nChange-Id: Icb0652a633ddbb8d562188f891c56a7d5367303e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95187\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "cad2630ed04f41e645c8791210df59c7d8d19e00", "tree": "53789da63fc17d276cac75f837843d50a024db4d", "parents": [ "05fb4bcd239ec7bd7db0d606dcf131e62e24509e" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon May 11 14:26:33 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 11 11:43:22 2026 -0700" }, "message": "Fix sectioning in ssl.h\n\nThe documentation generator expects two blank lines between sections.\n\nChange-Id: I70e9d4ba36ee11c1f388b70aab9452364edc4e7b\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95207\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "05fb4bcd239ec7bd7db0d606dcf131e62e24509e", "tree": "8628aa7cdc4c11f7f845a720ce75bbd5e8f273de", "parents": [ "16bb6cde3f7d7517b859df01320f9bcdb8c8567b" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Apr 30 13:18:20 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 11 09:39:11 2026 -0700" }, "message": "Fix typo in benchmark name\n\nChange-Id: Ic7b8e1ba85410f241b1845b16039b894872e24e8\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94487\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "16bb6cde3f7d7517b859df01320f9bcdb8c8567b", "tree": "39b6bea9f8610ced9e67638cfc242a59e245b20e", "parents": [ "df41163cb2463d62c9b217ea06aa667a1a01b706" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon May 11 12:06:51 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 11 09:35:33 2026 -0700" }, "message": "Fixup some minor issues in HPKE P-256 key derivation\n\np256_private_key_from_seed should reject the zero scalar. It is\ncomputationally infeasible to find any input that hits this case, so no\nunit test or practical consequence, but we should match the spec I\nsuppose.\n\nSee https://www.rfc-editor.org/rfc/rfc9180.html#name-derivekeypair\n\nAlso add some missing error checks for p256_public_from_private. Other\nthan the computationally infeasible zero scalar above, this is\nimpossible except for ec_point_mul_scalar_base\u0027s fault protection logic\n(which is impossible unless there\u0027s another bug or CPU fault).\n\nChange-Id: I6961601f4036829c8dba990922b4135c0e141df8\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95188\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "df41163cb2463d62c9b217ea06aa667a1a01b706", "tree": "41ff00d2aa4e5b0bde6b50069f6ed48f7f3ffa67", "parents": [ "0b3bdb2be5fa78ed210cb78efb43fceee1235193" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue May 05 10:57:23 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 11 09:19:58 2026 -0700" }, "message": "Tidy up poly1305 alignment a bit\n\npoly1305_vec.cc was not using the align_pointer helper. poly1305_arm.cc\nwas a bit of a mess. It had static asserts that we could align the\noverall struct, but it instead only aligned the array. But there\u0027s a\nsize_t there, so actually the whole thing needs to be aligned.\n\nChange-Id: Icf11544a83b2388a94ca54cda59a5a86f2708991\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94787\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "0b3bdb2be5fa78ed210cb78efb43fceee1235193", "tree": "d02c60bb26f3101bd1754d89e85e88759343d896", "parents": [ "e33a1a81ae78a13dab9f628740a26aebc0d35c46" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon Jan 26 19:17:29 2026 -0500" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 11 08:45:34 2026 -0700" }, "message": "Stop manually encoding various x86 extensions from perlasm\n\nConfirmed with objdump -d that object files remain unchanged.\n\nBug: 478924351\nChange-Id: I590f2a31ef32a79a5a06414a3a0675ecdb4cc9b3\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/87907\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "e33a1a81ae78a13dab9f628740a26aebc0d35c46", "tree": "7b97044fa896a89e4b3e0e555545c7b28798e741", "parents": [ "d7885e84d433ad088a0e73cc528a8bd57a812504" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon May 11 11:16:25 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 11 08:44:20 2026 -0700" }, "message": "Clear r-\u003eneg in bn_abs_sub_consttime\n\nThis has no practical consequences because this is only called\ninternally, in a context where we would never see negative numbers, but\nstill better to be tidy.\n\nChange-Id: I63f4fbc9180b86dd2aa5566467ed6e51f86ce917\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95167\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "d7885e84d433ad088a0e73cc528a8bd57a812504", "tree": "a9ce7b797559a8b3d833ac27f91ce0793c14d203", "parents": [ "9730fe2168ced0889a227855cbc28762f49c1bd5" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon May 11 03:21:02 2026 -0700" }, "committer": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon May 11 03:43:28 2026 -0700" }, "message": "Fork detection test: align the stack to 16 bytes.\n\nChange-Id: I90d5360f06cc46778aca828b2e1100106a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95127\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "9730fe2168ced0889a227855cbc28762f49c1bd5", "tree": "62cc39dd3af12821406469c678cde15a73f4974b", "parents": [ "d589045a772678d5ca131f4c8087d001b9258380" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon May 11 00:56:25 2026 -0700" }, "committer": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon May 11 01:06:49 2026 -0700" }, "message": "Disable fork detection test on qemu.\n\nIts madvise() is still broken today (just in a different way from the\npast - it still returns success on invalid advice flags, which means\nthat we cannot distinguish pre- and post-MADV_WIPEONFORK implementation\nversions of qemu.\n\nI also thought of another way - namely, checking MADV_WIPEONFORK on a\nMAP_SHARED mapping - which qemu correctly refuses, but FreeBSD\u0027s\nlinux.ko does not. So given it\u0027s inaccurate anyway, let\u0027s keep the\ncurrent detection and behaviour as is, namely, that we always draw\nentropy when needing random data when on qemu.\n\nChange-Id: Ib28994d8d22a7360dcfdcc8a6cc5e66f6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95107\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "d589045a772678d5ca131f4c8087d001b9258380", "tree": "a5e0eb0e05eec89c7a43552ee7dfc2cfe966b503", "parents": [ "a328f4f8fcc55db545acbf096d56d98248bcb082" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 08 11:02:06 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 08 04:25:09 2026 -0700" }, "message": "Bump version for Bazel Central Registry\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ie58754f63f236abe725739c5a2fa59206a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95048\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "a328f4f8fcc55db545acbf096d56d98248bcb082", "tree": "de37e0ad00cdc5fa7cebacc01627223d2c862c41", "parents": [ "d03b45948ec9af4ec01f3a9b5adc381c01966659" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu May 07 01:44:31 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 08 02:02:05 2026 -0700" }, "message": "Limit PEM data to 1 GiB.\n\nThere should be no single PEM block of this size in existence. This limit\nhowever guards against possible integer overflows in other moduels. A\nPEM block larger than this will be skipped by libpki (which has no way\nto report errors to begin with), and return ERR_R_OVERFLOW from\nlibcrypto.\n\nUpdate-Note: if you hit this, try reducing the size of your PEM blocks.\n\nChange-Id: I99962d363b54f40e963793f15f0dcda56a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94967\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "d03b45948ec9af4ec01f3a9b5adc381c01966659", "tree": "88c6813ebbb8b1e4f503c3b745c28ff16d892058", "parents": [ "a10c7ee55d346c0e5a05f9c2bdc360ca3b554f90" ], "author": { "name": "Victor Hugo Vianna Silva", "email": "victorvianna@google.com", "time": "Fri May 08 00:57:39 2026 +0100" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 07 19:19:35 2026 -0700" }, "message": "Roll windows toolchain\n\nUpdated following http://go/windows-sdk-cipd-update. I had to allowlist\nnew weak symbols, see bot failure below.\n```\nFound weak symbol without \"the_boringssl_prefix\": _Avx2WmemEnabledWeakValue\nFound weak symbol without \"the_boringssl_prefix\": time\n```\nhttps://ci.chromium.org/ui/p/boringssl/builders/try/win32_clang_prefixed_compile/b8682489395279125345/overview\n\nChange-Id: I91557cc09be921594373cf297acc66e500d98b67\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94947\nAuto-Submit: Victor Vianna \u003cvictorvianna@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "a10c7ee55d346c0e5a05f9c2bdc360ca3b554f90", "tree": "f24cb1f9ac6f13f1d6773360edd343981ef61062", "parents": [ "5b861a03d8a3c007ea9931b317a6f2670661118a" ], "author": { "name": "Victor Hugo Vianna Silva", "email": "victorvianna@google.com", "time": "Fri May 08 00:57:36 2026 +0100" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 07 19:19:19 2026 -0700" }, "message": "Fix presubmit errors in infra/config/main.star\n\nBefore this CL, trying to modify that file led to preexisting presubmit\nerrors. Fix them.\n\nChange-Id: Ief2c7e9d801e51865f339c63c8b099e62316a65a\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95027\nAuto-Submit: Victor Vianna \u003cvictorvianna@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "5b861a03d8a3c007ea9931b317a6f2670661118a", "tree": "544e97bd10a68d99c368fe840575515ccda394bc", "parents": [ "0e71ca41ee051e666a507033ecf30460fda01583" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu May 07 14:31:44 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 07 13:42:33 2026 -0700" }, "message": "Consistently fill in the sign bit in BN_lebin2bn and BN_bin2bn\n\nSome of the object reuse cases were leaving the sign bit unchanged.\n\nChange-Id: I9a41edd8e5a1eb330ea58ad442f7817306d32bbb\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95007\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "0e71ca41ee051e666a507033ecf30460fda01583", "tree": "5755cd3e32382817886e22fe1e5d87a4e2ec0a49", "parents": [ "716e655866b8a73234186856b067aa0ca111900b" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu May 07 06:06:04 2026 -0700" }, "committer": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu May 07 06:52:28 2026 -0700" }, "message": "Disable the tests for fork detection on Linux \u003c 4.14.\n\nApparently we have some on CQ.\n\nChange-Id: I915310ad9ca73f04538fa6eadc5abb4e6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94987\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "716e655866b8a73234186856b067aa0ca111900b", "tree": "0a6094c9386d70f41eb9bf8f9a734cc6307dec09", "parents": [ "6cd81fabe1f7f0a1d7890e04d3583c0f23a4d7dd" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue May 05 12:15:20 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 07 04:57:36 2026 -0700" }, "message": "Inherit hostflags verify params even without hosts\n\nThis aligns with\nhttps://github.com/openssl/openssl/commit/dfccfde06562ac87fe5e5f9401ba86cad050d9a2\nfrom upstream OpenSSL.\n\nUpdate-Note: If hostflags are configured on the X509_STORE, but hosts\nare only configured on the X509_STORE_CTX, the shared X509_STORE flags\nwill no longer be ignored. This aligns with OpenSSL\u0027s behavior.\n\nChange-Id: Ie2ef00121bf9746b5532b750c22bbd956e83d262\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94807\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "6cd81fabe1f7f0a1d7890e04d3583c0f23a4d7dd", "tree": "b357826937a594a1cbd1f2e63de56728d4087e4a", "parents": [ "fc9c1a3ad753b618d0e90c6d801931f66fb3584e" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed Apr 29 05:28:12 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 07 01:37:43 2026 -0700" }, "message": "Clean up bssl::PEM_read_bio_inner.\n\nFixes signed integer overflow on PEM data \u003e 2 GiB, missing error\ndescriptions on the error stack, randomly oversized allocations for no\nexplained reason, and replaces explicit memory management by UniquePtr.\n\nAlso, equally report an error of PEM_R_BAD_END_LINE if a headerless PEM\nhas a non-final line of length other than 64. The headerful PEM parsing\nalready does the same.\n\nChange-Id: I6a205fe692a052f19ef15f1b09b098856a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94327\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "fc9c1a3ad753b618d0e90c6d801931f66fb3584e", "tree": "859a2a765f82ce68add1d906e5dcbbccb812cc81", "parents": [ "6c236959898894b4356e1f8d69d9dfc7d3c432b9" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue Apr 28 04:49:04 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu May 07 01:36:19 2026 -0700" }, "message": "Fork detection: add rfork() and similar support for FreeBSD/OpenBSD.\n\nOn BSD systems, `pthread_atfork()` is insufficient, as e.g. `rfork()`\n(similar to Linux\u0027s `clone()`) can create processes too, and will not\ncall pthread\u0027s handlers. Use BSD\u0027s `minherit` mechanism to detect this\nkind of process duplication the same way as it works on Linux.\n\nThere would be similar problems if one were to use `vfork()` on some\nsystems. However, do note that according to POSIX.1, doing virtually\nanything in the `vfork()` child is undefined behavior, and we can\u0027t\nreasonably be expected to guard against undefined behavior in callers.\nmacOS even deprecated the function and shows a warning for any use of\nit.\n\nI believe this will not actually hit any real-world software, and am\nmerely adding this to be sure.\n\nManually tested on OpenBSD:\n\n```\ngrawp$ uname -a\nOpenBSD grawp.my.domain 7.1 GENERIC.MP#465 amd64\ngrawp$ ./crypto_test --gtest_filter\u003d\u0027*Fork*\u0027\nNote: Google Test filter \u003d *Fork*\n[\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d] Running 3 tests from 2 test suites.\n[----------] Global test environment set-up.\n[----------] 2 tests from ForkDetect\n[ RUN ] ForkDetect.Test\n[ OK ] ForkDetect.Test (7 ms)\n[ RUN ] ForkDetect.TestAlternate\n[ OK ] ForkDetect.TestAlternate (0 ms)\n[----------] 2 tests from ForkDetect (8 ms total)\n\n[----------] 1 test from RandTest\n[ RUN ] RandTest.Fork\n[ OK ] RandTest.Fork (4 ms)\n[----------] 1 test from RandTest (4 ms total)\n\n[----------] Global test environment tear-down\n[\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d] 3 tests from 2 test suites ran. (13 ms total)\n[ PASSED ] 3 tests.\n```\n\nand on FreeBSD:\n\n```\n[rpolzer@grawp build (git)-[d03c3135d]-]$ uname -a\nFreeBSD grawp 15.0-RELEASE-p6 FreeBSD 15.0-RELEASE-p6 releng/15.0-n281024-6b6bc9afa0b0 GENERIC amd64\n[rpolzer@grawp build (git)-[d03c3135d]-]$ ./crypto_test --gtest_filter\u003d\u0027*Fork*\u0027\nNote: Google Test filter \u003d *Fork*\n[\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d] Running 3 tests from 2 test suites.\n[----------] Global test environment set-up.\n[----------] 2 tests from ForkDetect\n[ RUN ] ForkDetect.Test\n[ OK ] ForkDetect.Test (2 ms)\n[ RUN ] ForkDetect.TestAlternate\n[ OK ] ForkDetect.TestAlternate (0 ms)\n[----------] 2 tests from ForkDetect (3 ms total)\n\n[----------] 1 test from RandTest\n[ RUN ] RandTest.Fork\n[ OK ] RandTest.Fork (1 ms)\n[----------] 1 test from RandTest (1 ms total)\n\n[----------] Global test environment tear-down\n[\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d] 3 tests from 2 test suites ran. (5 ms total)\n[ PASSED ] 3 tests.\n```\n\nTested on both that without this change, the added test fails.\n\nUpdate-Note: if you seriously sidestep the OS-level proper channels of\ncreating a new process duplicating address space, stop doing that, or at\nleast do not call BoringSSL from the so-forked process. In general, any\naddress space duplication shall be done using `fork()` and `fork()`\nonly.\n\nChange-Id: I11f0c3e868a36ca5a1ab8b605c40f9856a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94247\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "6c236959898894b4356e1f8d69d9dfc7d3c432b9", "tree": "4c0665b513f8225eee2fa3581d0d51bbec974eb4", "parents": [ "950495856681c75e929963673dff12351378af60" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed May 06 14:18:52 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 15:20:25 2026 -0700" }, "message": "Implement libpki\u0027s HexEncode function more straightforwardly\n\nUsing ostringstream is a bit overkill.\n\nChange-Id: Id23d35daa8e223dee71af0519544aa685307b41d\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94930\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "950495856681c75e929963673dff12351378af60", "tree": "9d1cad3eb184b95aeb2ea793d0ce6acc45b49f1e", "parents": [ "f47fe451ec565e3f6a79a227fc7d3a3264854b92" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed May 06 14:13:38 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 12:11:40 2026 -0700" }, "message": "Remove internal NumberToDecimalString helper\n\nAs the TODO suggests, std::to_string works just fine here.\n\nChange-Id: I1be992a513e2a8d6e4b9cf2faf48c49c0f47b10e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94929\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "f47fe451ec565e3f6a79a227fc7d3a3264854b92", "tree": "a6199e6af700aa9f4f2371dd4669eebedf32df52", "parents": [ "44bb9936deb46a62b46b8e9ce7a2526ef1a62a82" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed May 06 14:09:03 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 12:06:33 2026 -0700" }, "message": "Align libpki\u0027s PEM parser with crypto/pem a bit\n\nBoth our crypto/pem and Go\u0027s encoding/pem tolerate whitespace in the\nmiddle of the line, and also only treat \u0027 \u0027, \u0027\\t\u0027, \u0027\\r\u0027, and \u0027\\n\u0027 as\nwhitespace. Align the libpki one with crypto/pem.\n\nAs part of this, remove the overcomplicated CollapseWhitespaceASCII\nfunction. That was seemingly adapted from Chromium //base, where it is\nused for a different purpose.\n\nUpdate-Note: libpki\u0027s PEMTokenizer now allows whitespace in the middle\nof a line, matching other implementations, and disallows \u0027\\v\u0027 and \u0027\\f\u0027,\nalso matching other implementations. This is not expected to have any\nreal impact.\n\nChange-Id: I349dc86762e5e1c184448b6170e4113579f2c43f\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94928\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "44bb9936deb46a62b46b8e9ce7a2526ef1a62a82", "tree": "7b9c3e67f3e543798b5c062ee44b827d2df84d5d", "parents": [ "e40836f3cad36cbab7299503aba9871c98a2618c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed May 06 13:51:05 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 12:02:57 2026 -0700" }, "message": "Add some tests to capture libpki\u0027s PEMTokenizer behavior\n\nLater we should align this with crypto/pem, but start by just\nunderstanding what our behavior is. In particular,\nCollapseWhitespaceASCII is kinda nonsense. That seems to have been\ncopied out of Chromium, where it\u0027s doing a much more complicated\noperation.\n\nChange-Id: I98b2838427a9b5479977faaaef689c4f0862d91e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94927\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "e40836f3cad36cbab7299503aba9871c98a2618c", "tree": "1dc6cbb9bb6d3d63d04017b5a4b1c4879e34c8b2", "parents": [ "6474716769bcf85be5509b728af82a988f26fb2e" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon May 04 04:44:55 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 10:27:06 2026 -0700" }, "message": "Clear the counters for empty or warning records only on actual data.\n\nFixes a minor issue where a peer can alternate between empty and\nwarning-only alert records, which applications might find confusing if\nthey try to account for activity of the connection at an upper layer.\n\nChange-Id: I3103e0f4b8979c075eb7f3b5591ec0e66a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94607\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "6474716769bcf85be5509b728af82a988f26fb2e", "tree": "55a5d7080c7d078dfec77633823040fb22bd76db", "parents": [ "5ba59630fc24fd8ec730028938086715a5fee170" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed Apr 08 16:58:59 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 08:07:03 2026 -0700" }, "message": "rust: bssl-tls: Raw Public Key credentials\n\nBug: 479599893\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I8e6a335d6038568ec7117f8a3b7a0e2f6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/92227\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "5ba59630fc24fd8ec730028938086715a5fee170", "tree": "9f7cf7d8013fb4a38de9c978b774fa8e1f587a98", "parents": [ "fb16e33126f828bc93f8138d9554b1a143ca197f" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed May 06 06:15:51 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 06:44:40 2026 -0700" }, "message": "Fix integer overflow in CollapseWhitespaceASCII.\n\nParsing PEM files \u003e 2 GiB could overflow an integer and cause memory\noverwriting.\n\nChange-Id: I0cc6cdbcc73fec2d27530f163ec70bbc6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94909\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "fb16e33126f828bc93f8138d9554b1a143ca197f", "tree": "8dab24cd59ff20516168477e8eabad45c3e695d6", "parents": [ "854c044693551a640add457d148ee5d6db33d8aa" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 08:23:29 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 06:28:12 2026 -0700" }, "message": "x509: Use explicit has_value on optionals\n\nIn the last patch not all such cases were caught.\nWe should clean them all up by now.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I1705878afa53a02b0c33b446aa4aa0b56a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94867\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "854c044693551a640add457d148ee5d6db33d8aa", "tree": "90fd9598e5f9cb2aba38ec36d47c1f5f339a8483", "parents": [ "dc5afebff8be90d53d76d3c3afefe0b77c483d6a" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed May 06 03:59:38 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 06 05:39:54 2026 -0700" }, "message": "TRUST_TOKEN_ISSUER: add missing `return 0` when trying to set a too small metadata key.\n\nChange-Id: Ib16506f433f2a953edd196531ea719336a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94907\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "dc5afebff8be90d53d76d3c3afefe0b77c483d6a", "tree": "9a71ce5afc7543c2f379e0fd9eaf7e0c59d5e8d2", "parents": [ "fbca91cccccdf0d6259fd80ad505e5a75cf6547c" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue May 05 17:14:33 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 05:17:23 2026 -0700" }, "message": "rust: bssl-tls: feature gate the sync_io module\n\nIt needs `std` environment to work really.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I4589296ec144b52982228c663968a0bc6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94827\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "fbca91cccccdf0d6259fd80ad505e5a75cf6547c", "tree": "d52a6d40577713dc7a888f16eb0c09c5d22fe01c", "parents": [ "081c202d237c1c9d721ddeb0f0130560465d3c5a" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 10:14:29 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 04:55:36 2026 -0700" }, "message": "rust: bssl-tls: Expose bssl_sys::SSL handle from `TlsConnection`\n\nUpon user request, out of necessity to interact with other FFI libraries\nwe could expose a convenient wrapper around transmutes because we do not\nwant to commit type layouts to a public API contract yet.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ie9d80a5d6e8b50213648cc1aa075a99d6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94887\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "081c202d237c1c9d721ddeb0f0130560465d3c5a", "tree": "c62c67f30fbc6d97dd633ac2b8c8d8ae2d487b78", "parents": [ "c9f0d64052018ed27830f890a2d2598b62b2aeb5" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 07:25:54 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed May 06 01:59:07 2026 -0700" }, "message": "perlasm: Conform to the visibility convention and fix typo\n\nIn the rest of the perlasm repository, it has been `.globl` visibility\ndirective coming before the rest.\nAlso visibility on `abi_test_get_and_clear_direction_flag` was not set\ndue to a typo.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Id0a0901bc0eaf51042777473a60099426a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94847\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "c9f0d64052018ed27830f890a2d2598b62b2aeb5", "tree": "407be3488a1698784db625727c80dd5700687954", "parents": [ "7d398e70e54c7eea8be1dc0877cb0e4fdd75d6a9" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue May 05 12:18:10 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 15:25:27 2026 -0700" }, "message": "ssl: const-correct SSL_CREDENTIAL\n\n\nUpdate-Note: Functions like `SSL_CTX_add1_credential`\nand `SSL_add1_credential` now accepts `const` handles to the credential\nobjects. Users can now use `SSL_CREDENTIAL_dup_ref` to duplicate a const\nhandle.\n\nBug: 505090843\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I348950e7bceb30a922e5f0a77b9d70176a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94747\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "7d398e70e54c7eea8be1dc0877cb0e4fdd75d6a9", "tree": "acd26e9d7769c6baab656fa31ef7014357184f11", "parents": [ "aa77bfac35cfcc0772ccb8d0765bf4842d29629b" ], "author": { "name": "Rudolf Polzer", "email": "divVerent@gmail.com", "time": "Thu Apr 16 03:59:45 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 13:56:15 2026 -0700" }, "message": "Implement a vectorized \"double Keccak\".\n\nGains 10% on AMD EPYC 7B13 and 19% on Apple M1 Pro.\n\nBug: 503700354\nChange-Id: If3faab601d5d30a41f54cb7306d04a586a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/92829\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "aa77bfac35cfcc0772ccb8d0765bf4842d29629b", "tree": "e4e4e95766d859c7a1fc39f9946a24f9af1192cb", "parents": [ "72540d5a7eb8f9c4c92951bb66decf8ea2289cf0" ], "author": { "name": "xfding", "email": "xfding@google.com", "time": "Thu Mar 19 13:43:44 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 12:15:59 2026 -0700" }, "message": "rust: bssl-tls: Introduce custom certificate verification\n\nBug: 479599893\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Iedb81134808f540f7f2d34c1c20927416a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/91087\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "72540d5a7eb8f9c4c92951bb66decf8ea2289cf0", "tree": "53f4be1513315fc53abc88c094f50730c85db51b", "parents": [ "9bce21d73b7e5b239c5c2381f9afb841fafa267c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue May 05 13:07:45 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 11:06:05 2026 -0700" }, "message": "draft-ietf-tls-tls13-pkcs1-00 is now RFC 9963\n\nChange-Id: Iaa1f78a6081973a8b3f4b5b3a3dc6048debc6ac4\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94810\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "9bce21d73b7e5b239c5c2381f9afb841fafa267c", "tree": "d57d514f0a23746a33e215fa6f8ef52f99872d1f", "parents": [ "580a524796fac0d6e8f87ca06ac60efce1b838c4" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue May 05 12:29:19 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 11:01:37 2026 -0700" }, "message": "Fix BIO_set_retry_special\n\nTest this by using this helper in connect BIOs too and making sure that\ndidn\u0027t start breaking.\n\nChange-Id: I2ea93446dd6490d9a026cd85c6058b3cbf663789\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94809\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "580a524796fac0d6e8f87ca06ac60efce1b838c4", "tree": "80b7ef20a6138b17978e0bb21f6fb500a9c336d7", "parents": [ "b84dc606410ec1d8e2f779de5ec6791d2951308e" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue May 05 12:58:50 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 10:32:42 2026 -0700" }, "message": "Test non-blocking connect in connect BIOs\n\nI\u0027m a little surprised this test reliably works on loopback, but it\nseems to be OK. Let\u0027s see what the CQ thinks.\n\nChange-Id: I71ede5bd64d8fb82e346b44f27d53475f41677ec\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94808\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "b84dc606410ec1d8e2f779de5ec6791d2951308e", "tree": "a9e86a6d75f0f68c6ef951f1e8459db77e881053", "parents": [ "4e17cdd8d774a79eddee191918ccbb8a6a174f46" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Apr 15 16:25:31 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 08:15:48 2026 -0700" }, "message": "crypto/x509: Tighten URI name constraints parsing and matching\n\nThis change uses stricter URI parsing to validate the name constraint\nand the name being matched.\n\nBug: 487820706, 502006234\nChange-Id: I02210878af377505a903bb999f9a8ef46a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/92687\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "4e17cdd8d774a79eddee191918ccbb8a6a174f46", "tree": "ca04931c281fff36251883d136e68cde5fed3e2f", "parents": [ "9e2bf26637102b0a64ba5330350421a327545a4c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue May 05 10:40:23 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 08:03:09 2026 -0700" }, "message": "Fix return value in x509_print_rsa_pss_params error path\n\nChange-Id: I7be2be148cb6a9c3a0ca37fca8124d62a1859889\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94767\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "9e2bf26637102b0a64ba5330350421a327545a4c", "tree": "52db3d44cdd619e9c1c83bb5a95c60caedf48920", "parents": [ "1dd1981096c30d0d9f0c8a848cb78b47f6322740" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue May 05 07:09:40 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue May 05 03:03:59 2026 -0700" }, "message": "rust: bssl-tls: Do not depend on `tracing` yet\n\nAlthough we have a future plan for introducing `tracing` support,\nit is still too early for quality-of-life improvements.\n\nBug: 509745646\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I91023ad3b6f84e7dc8a3e04907a012e36a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94707\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "1dd1981096c30d0d9f0c8a848cb78b47f6322740", "tree": "35e85d6f02a229a703596784d2368395dcf61e08", "parents": [ "2a8e86174536b735a777a56897c7949d33bd46a6" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue Apr 21 22:18:50 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 00:37:21 2026 -0700" }, "message": "crypto: Make X509* and EVP_PKEY* const clonable\n\nThis will make future API design easier for const-correctness.\n\nBug: 505090843\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I9976888078589e0c7274457bb1591de16a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93347\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "2a8e86174536b735a777a56897c7949d33bd46a6", "tree": "5fd8ba7497563efefe226d9c2cc9f342403c21d6", "parents": [ "4868e33ed7b2be94cb63f37db62b29bacb7cb72d" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon May 04 17:56:40 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 00:05:23 2026 -0700" }, "message": "bssl-crypto: Stop gating ML-DSA on a Rust feature flag\n\nThis was done because some Rust consumer had too old of a Rust compiler,\nbut it\u0027s been a year now. Retire this.\n\nUpdate-Note: bssl-crypto now depends on at least Rust 1.82, if it hadn\u0027t\nalready taken on a newer dependency by now.\n\nChange-Id: I25bab38508ed712c5cdd6c3ffc708188ce769da9\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94687\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "4868e33ed7b2be94cb63f37db62b29bacb7cb72d", "tree": "595ce028771e7c9533dd445bd63bec01a94e7fe4", "parents": [ "14e014ff7c0e959537701ef962565c78ae1280fc" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Sat May 02 19:12:57 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon May 04 16:49:32 2026 -0700" }, "message": "rust: bssl-tls: Remove TlsConnectionRef\n\nSince we are no longer carrying certificate cache in the connection\nobject, `TlsConnection` can be made into a \"thin wrapper\" again.\n\nIn the future design, we will park any additional data to an ex_data\nslot.\nThe thin wrapper design will stay.\n\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I2da226e367f37f11f3a17ad2e91508646a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94667\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "14e014ff7c0e959537701ef962565c78ae1280fc", "tree": "86ea756c3b93c6acaec07883161e1bc0dcf33cb3", "parents": [ "e8ab7ae3d0400b21fad0a657402d2330f6c98c87" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Sat May 02 19:12:57 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon May 04 16:48:22 2026 -0700" }, "message": "rust: bssl-tls: Promote CertificateCache to a full ref-counted type\n\nGiven that `CRYPTO_BUFFER_POOL` is now a ref-counted type, so should be\n`CertificateCache`.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: If40fd0fbeb29f393883c82e86ac21e1c6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94548\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "e8ab7ae3d0400b21fad0a657402d2330f6c98c87", "tree": "d329462d206419d06a603f1edf9394e2c758d5c7", "parents": [ "e02c2889b5b969be1e65c9b1f29d120e23358404" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Apr 28 12:12:48 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 04 16:39:26 2026 -0700" }, "message": "Use placement new to initialize the atomic into the WIPEONFORK page\n\nThis already goes outside the C++ object lifecycle because the OS is\nwriting to the page, but we may as well initialize the value the more\nCorrect way. (Implicit object creation probably covers this anyway.)\n\nChange-Id: Iec770d3826393f95769ebf87c77a0d5039b05dc1\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94288\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "e02c2889b5b969be1e65c9b1f29d120e23358404", "tree": "7c17914234e789fc0f01d13c685c596404cc4ae0", "parents": [ "e20b0220e903a1dbe32846eb29018253721f1bf8" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon May 04 10:13:13 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 04 16:38:57 2026 -0700" }, "message": "Implement EVP_HPKE_KEY_derive\n\nFor applications that need the DeriveKeyPair feature. I used a little\nbit more spans here, but haven\u0027t gone through and spanified the existing\ncode.\n\nFixed: 504975042\nChange-Id: I7c82adb817eed96e05df4c89fe118d54c4439161\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94648\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "e20b0220e903a1dbe32846eb29018253721f1bf8", "tree": "4e5a14362e877ed729c772ca88dc439bdf367fad", "parents": [ "65818adf16411ca394625f5747a1af28faf95d2c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sun May 03 17:32:58 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 04 15:03:11 2026 -0700" }, "message": "Use HPKE-PQ test vectors from the spec\n\nI\u0027m not sure where these test vectors came from. They were added to the\ngenerated file and would be clobbered if we ever re-ran the generator.\nInstead, import the test-vectors.json file from HPKE-PQ and adapt the\ngenerator to convert both separately.\n\nIn doing so, fix up some inconsistencies about what we consider to be\nthe \"seed\" input to EVP_HPKE_CTX_setup_sender_with_seed_for_testing. We\ngenerally match ikmE, except for X25519 where we use skEm. (There is no\nreal consequence to using one or the other.)\n\nAs part of this, we have to contend with the spec pairing ML-KEM-1024\nwith HKDF-SHA-384. It would be nice to not have so many of these, but\ngiven that adding HKDF-SHA-384 is a small scattering of lines, probably\nwe just add it and don\u0027t think about it too hard.\n\nChange-Id: I35396fac367d6c13075e8fda2efaaf3c486e97e1\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94647\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "65818adf16411ca394625f5747a1af28faf95d2c", "tree": "ca08f6b0e45e85975bcbfef8e948d728dd2f4dd0", "parents": [ "39f453188c5b8337bdd956672f4168ded717e2ee" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Sun May 03 20:28:16 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon May 04 12:22:06 2026 -0700" }, "message": "rust: bssl-tls: fix MockSocket behaviour on pending read\n\nIn the previous revision, when the deque is empty, a transaction size is\nzero.\nIn this case, async sockets should return Retry instead of returning\njust zero bytes read.\n\nSync sockets should block and suspend a thread.\nThis behaviour will be implemented in a later revision.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I6b1098fae02a52fc5834e5f0f6c80f3b6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94547\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "39f453188c5b8337bdd956672f4168ded717e2ee", "tree": "e0f5337c41b5bbaa4b580e39c8e3f07319d3fef9", "parents": [ "9c81e5c102b321cae203437e8ab2871800ef451f" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Mar 26 21:48:56 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon May 04 10:36:47 2026 -0700" }, "message": "rust: bssl-x509: rename our panic-catcher\n\nDue to historical reason, the name describing the old panic handling\nstrategy lingered around.\nIt should be now very clear that we force an abort on panic to stop the\npanic from crossing the FFI boundary.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ie322215c3d3ac96a1245904c42bf87ad6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/91607\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "9c81e5c102b321cae203437e8ab2871800ef451f", "tree": "35ad24de09a44aff8e044bb9f7563e54655d0f38", "parents": [ "742a4d2db6321baf8af8e856b812630ef741fc24" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon May 04 16:09:47 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon May 04 10:17:27 2026 -0700" }, "message": "x509: Switch from implicit `bool`-conversion to `has_value`\n\nUsing the `bool` conversion is arguably against our style guide.\nWe should be more explicit about our intent in these cases.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ia95314731cefe20e44279ef41d9899d66a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94627\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "742a4d2db6321baf8af8e856b812630ef741fc24", "tree": "4cb0bdee28c946989f342e80fd295f64911e692b", "parents": [ "aef0e2df53d9b2357c2e7ee7e93fc869214a00b4" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Apr 30 01:30:40 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 04 04:43:43 2026 -0700" }, "message": "Update Wycheproof test vectors\n\nThis picks up some ECDSA test vectors that we contributed, as well as\nsome more ML-DSA tests.\n\nChange-Id: Iec872ed704730c0bcd019cdf205bf05805a2933c\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94427\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "aef0e2df53d9b2357c2e7ee7e93fc869214a00b4", "tree": "9dcb942ef347fcaaaee5a64342373abba3f8f1c8", "parents": [ "7a441c6bba12b1dee1dc39b362f73caa4d0cd4d3" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Apr 30 11:55:09 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 01 15:08:45 2026 -0700" }, "message": "Reference-count CRYPTO_BUFFER_POOLs\n\nSSL_CTX_set0_buffer_pool was a difficult API to use correctly, if you\ntried to free your buffer pools. (It was envisioned as being mostly used\nwith global pools.)\n\nYou had to ensure the pool outlives the SSL_CTX, but the SSL_CTX is\nreference-counted, so it is hard to be sure when the SSL_CTX will be\ndestroyed. SSL objects, in particular, extend the lifetime.\n\nInstead, just reference-count the pools. Note that buffers still do not\nown references to their pools. That is still a weak reference. We\nprobably could promote it to a strong reference now, but no need to keep\nthe hash table around when we don\u0027t need to.\n\nWith that, deprecated SSL_CTX_set0_buffer_pool in favor of\nSSL_CTX_set1_buffer_pool, though SSL_CTX_set0_buffer_pool now internally\ntakes the refcount to and becomes safer automatically. (This should be\nbackwards-compatible.) I\u0027ve switched calls within the library to the\nset1 spelling but left bssl-tls alone for now, since bssl-tls can\nprobably take other simplifications at the same time.\n\nChange-Id: I1421b44cc129c7f2d7090538ac595a5530688f2f\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94467\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "7a441c6bba12b1dee1dc39b362f73caa4d0cd4d3", "tree": "f3ac3f32f3ed8a4a75770e6089834dde85ac3848", "parents": [ "8aab3043e6cb72a8de4aaa3d055f118d23661e5a" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon Apr 27 21:43:57 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 01 14:30:15 2026 -0700" }, "message": "rust: bssl-tls: Sessions for TLS 1.3\n\nBug: 479599893\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I0a718492703d5ec2d358155efb6a4d5e6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94228\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "8aab3043e6cb72a8de4aaa3d055f118d23661e5a", "tree": "038d4df58ddd2322af4c872def39cdf07e2931f2", "parents": [ "b771573651eb93965bce27ff3c21053233d80a80" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 01 11:30:04 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 01 14:24:40 2026 -0700" }, "message": "rust: bssl-tls: Carve out tokio support into its own crate\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I88b143506455afdb6c51d3914eddc0b26a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94508\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "b771573651eb93965bce27ff3c21053233d80a80", "tree": "dcdb17d3b81084676721a24f38e5e0ed5dbc9bde", "parents": [ "6935e82fd3efbb78c07aca3350839fe14ba6ecdd" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed Apr 08 16:58:59 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 01 13:54:04 2026 -0700" }, "message": "rust: bssl-tls: I/O mocking infrastructure\n\nThe new types mocks a socket for testing only with an optional async\nmode.\n\nBug: 479599893\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ifa742ec158a4f906df46c0e51d00d29b6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94507\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "6935e82fd3efbb78c07aca3350839fe14ba6ecdd", "tree": "b806e2516a27c53e8df0afc0983820882fdcee30", "parents": [ "a1c146745137642dfb53a1ec12ebe79817b31584" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Apr 09 13:03:13 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Fri May 01 13:03:46 2026 -0700" }, "message": "rust: bssl-tls: General functional tests\n\nBug: 479599893\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I7bc900c38a43ba00c936e679bfe927396a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/92347\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "a1c146745137642dfb53a1ec12ebe79817b31584", "tree": "faae0b548b3b10579a5c8fd6c531e484a2e3ec4a", "parents": [ "57b745ed880db2a533c02d3ec508fa5b2bd24b3d" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Apr 30 12:14:20 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Apr 30 05:40:26 2026 -0700" }, "message": "rust: bssl-tls: Formatting and feature gate fix\n\nThere are imports that are not properly gated, leading to unused import\nlints.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I4270eafb224d0dc114c8bc9d84f233946a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94447\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "57b745ed880db2a533c02d3ec508fa5b2bd24b3d", "tree": "f51412f3c6dac3be695f28bb18dc3688590def91", "parents": [ "aedc995368f5631c9e004155be02575911445927" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Apr 29 15:59:35 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 29 23:29:42 2026 -0700" }, "message": "audit_symbols: Allowlist stdext:: weak symbols on Windows\n\nThese are generated by MSVC for symbols not yet in the ISO C++ standard.\nhttps://learn.microsoft.com/en-us/cpp/standard-library/stdext-namespace\n\nChange-Id: I208f3b67e1c4c1c3f511617ecb4cd4ce6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94367\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "aedc995368f5631c9e004155be02575911445927", "tree": "eab1d8aea1df7e951f5c512033f7aa932450a1ce", "parents": [ "bb9fc5fb90f5a9e12d5cd3c7341c67927db2dcf1" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sat Apr 25 17:10:34 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 29 22:51:25 2026 -0700" }, "message": "Modernize crypto/x509/policy.cc a bit\n\nReplace the STACK_OF(T) with bssl::Vector, which doesn\u0027t force us to\nallocate quite as many things. This removes a couple uses of\nDEFINE_NAMESPACED_STACK_OF.\n\nIn principle we could tighten it up further. OIDs should never need to\nbe allocated (they\u0027d always reference the underlying certificate). But\nto do that, we would need to get away from crypto/x509\u0027s\nallocation-heavy in-memory representations of objects. For now, we just\nallocate.\n\nChange-Id: Ic81df946a0eecf8fe7c2d933f5793a56d3e86020\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94047\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "bb9fc5fb90f5a9e12d5cd3c7341c67927db2dcf1", "tree": "e7e9aa739867cbd29edc3c7e5eb49d8d8b0843fd", "parents": [ "7b20b3cd64de7b9ce23d61f57f95eff9502dbe24" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Mon Apr 20 21:55:48 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 29 14:52:50 2026 -0700" }, "message": "Add helpers to match characters in CBS\n\nNeeded for URI parsing in crypto/x509.\n\nChange-Id: I15c04d535d2453538c38502e127c295a6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94307\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "7b20b3cd64de7b9ce23d61f57f95eff9502dbe24", "tree": "c110ce925fcd24fadc3dc2e9be24cf0bae56debc", "parents": [ "271b64a2bbc977e77b0af5d00191b041b8920046" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Apr 29 15:33:04 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 29 14:43:24 2026 -0700" }, "message": "Various IWYU fixes\n\nChange-Id: Ife51c3d80a5a357c49263dc476f32a5fd216cf04\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94407\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "271b64a2bbc977e77b0af5d00191b041b8920046", "tree": "9c2213fd341113d5f01e84cafd4b1e0a09a86e1b", "parents": [ "75a048d9738a6fd3b7eaa3cee6cc4893238f6751" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Apr 29 13:02:18 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 29 14:28:37 2026 -0700" }, "message": "Check for negative bit indices in ASN1_BIT_STRING_set_bit\n\nA negative bit index is incoherent, but we should check for such things\nand return an error.\n\nFixed: 506302938\nChange-Id: I85becd972f681620d2069564e705be63cc26ddb1\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94387\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "75a048d9738a6fd3b7eaa3cee6cc4893238f6751", "tree": "3109c10e743f2e83865d2852961f3d81629caf53", "parents": [ "04aa32f96f3094994a2971d703f7489b75b94f84" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Tue Apr 21 16:56:13 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 29 09:39:10 2026 -0700" }, "message": "Hook up X-wing to EVP_KEM\n\nFixed: 503739373\nChange-Id: I40f0d46e2753c002ac5a3e98d63e641f6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94207\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "04aa32f96f3094994a2971d703f7489b75b94f84", "tree": "637d39027dc61f21db0567c8e1b72e07d3c04fc2", "parents": [ "ac5067e905a42b4a5e608d821a837805f94f295f" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sat Apr 25 20:01:45 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 15:42:49 2026 -0700" }, "message": "Fix the legacy AES-GCM API\u0027s IV resizing logic\n\nWith the right sequence of resizes and copies, aes_gcm_ctrl breaks the\ninvariant that IV lengths below EVP_MAX_IV_LENGTH stay in the built-in\nbuffer and things get confused. Fix this by maintaining the invariant\nmore strongly.\n\nThis is not expected to impact any actual callers as there is no reason\nto repeatedly change the IV length like this. And as this is not an\nintrinsic part of the primitive, just extremely weird OpenSSL API\ndecisions, it\u0027s also unlikely this API was directly transcribed to some\nkind of untrusted execution environment like JavaScript.\n\n(There is also no reason to change AES-GCM\u0027s IV length. That was a NIST\nmistake.)\n\nChange-Id: I87df7764b9c1e7ee3ac524e8b70ee70d8a7ff16e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94087\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "ac5067e905a42b4a5e608d821a837805f94f295f", "tree": "4c0718b4a5398c2115d3483e0781e263bfdbd512", "parents": [ "61e81eb77eb5542f3e71563d957464ee5927256e" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Tue Apr 28 20:20:22 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 15:09:42 2026 -0700" }, "message": "Move some code around in v3_ncons.cc\n\nThis rearranges code and moves it into an anonymous namespace.\nNo logic/behavior changes in this CL.\n\nChange-Id: Icba86eb1c36d906d6c6c276e18f30cd46a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94308\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "61e81eb77eb5542f3e71563d957464ee5927256e", "tree": "2c02a20085b6126a9fa41ad7f12b4a45fc60c8c9", "parents": [ "929f91fc5d27b2a5f2e457e40cb4876b13b492ac" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Apr 28 11:51:24 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 12:15:06 2026 -0700" }, "message": "Fix up v2i_NAME_CONSTRAINTS\n\nUse UniquePtr and and also fix a missing check for malloc failure.\n\nChange-Id: Id1baa40b659838dded932689c84beea82f1ebb84\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94268\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "929f91fc5d27b2a5f2e457e40cb4876b13b492ac", "tree": "1bc43163d65ab92884a939b0f7855d90837e3f1e", "parents": [ "1f6e73198dad35f08a8de75175ee7d33e231ba9c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Apr 28 12:06:37 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 12:11:48 2026 -0700" }, "message": "Add tests for nameConstraints\u0027 ad-hoc config parser\n\nThis trips -Wframe-larger-than warnings on unoptimized builds. Limit\nthat flag to release builds. Trying to control for stack sizes on\nunoptimized builds seems to be hopeless in general. (b/119256917 has a\nlong discussion and b/3349057 has an example of a particularly absurd\ncase.)\n\nChange-Id: I904b8dcc89b314bbbe7ec0c222994debabba01d1\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94287\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "1f6e73198dad35f08a8de75175ee7d33e231ba9c", "tree": "37c2084bf3fb39de3d29f6fe8a645093469791ba", "parents": [ "f50cce8b25428a9f643c3010d543e8254c2c7840" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Apr 28 11:43:27 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 09:30:59 2026 -0700" }, "message": "Clear the sorted bit after sk_FOO_set\n\nChange-Id: I8f50389ff950475ea6fc317d71ecaca1eeb7bd5a\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94267\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "f50cce8b25428a9f643c3010d543e8254c2c7840", "tree": "651ce2fa3d3ff01f0a44771737d86eca55535007", "parents": [ "0b5b5ff2d3f780752166d2fdf3078b707aa35d4d" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon Apr 27 21:43:57 2026 +0000" }, "committer": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue Apr 28 07:32:44 2026 -0700" }, "message": "rust: bssl-tls: Add MLDSA into list of signature algorithms\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I0eb23d71b32820b3f65ee19d4fbdb8f26a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94227\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "0b5b5ff2d3f780752166d2fdf3078b707aa35d4d", "tree": "c9dfbc31c4a7fbafa6f46f8012efa6dda783728c", "parents": [ "102f5c5441a8ff0dd06525a15d9e0eba849ae9bf" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sat Apr 25 13:30:05 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 07:29:04 2026 -0700" }, "message": "Tidy up ownership a bit in X509_get1_email and friends\n\nChange-Id: I7985f2f7a5b7ff6d80b0415a918a9423e7bb045e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94030\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "102f5c5441a8ff0dd06525a15d9e0eba849ae9bf", "tree": "c5ac1af8250d17ee4d7557cae3ab2dfb87a0bb4a", "parents": [ "8415495eff36b92242762f55f22aa52a7e6f89df" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sat Apr 25 13:08:42 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 28 07:22:25 2026 -0700" }, "message": "Defer dedup in X509_get1_email and friends to the end\n\nChange-Id: If92c9d954a7721d24734fe6b749cb73894ae2093\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94029\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "8415495eff36b92242762f55f22aa52a7e6f89df", "tree": "f98302d2059e418c89fd8c319a7146c26f9dd5ee", "parents": [ "06212ed65c55689482c76c2a3c57281cff53f7c2" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Fri Apr 24 21:41:20 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 16:36:30 2026 -0700" }, "message": "Unwind EC_FELEM hooks on EC_METHOD\n\nThese are now all the same implementation because our EC_FELEM code is\n(currently) all generic. This does mean we don\u0027t get to use the\nspecialized field arithmetic, but we\u0027d ideally want to cut at a slightly\nhigher point anyway.\n\nBug: 505908440\nChange-Id: Id851ce2d654a2257f336cfe44d2db608aa401635\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93947\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "06212ed65c55689482c76c2a3c57281cff53f7c2", "tree": "7930b387aad12f002103a3fcbebfe36f95fc73ca", "parents": [ "b9696cb4e9c60bb51de6ffe89588962e221f3a31" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Mon Apr 27 16:51:50 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 12:42:57 2026 -0700" }, "message": "Add an EVP adapter for KEM encap/decap\n\nThis allows expressing the EVP_PKEY_CTX_METHOD encap/decap in terms of\nthe corresponding EVP_KEM.\n\nBug: 503739373\nChange-Id: Ie8077303a47df136fcbb165834f13e6a6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94147\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "b9696cb4e9c60bb51de6ffe89588962e221f3a31", "tree": "43db1ad8daf13fdede738d2acf46d5d695a64a64", "parents": [ "4d124cf20d9fdfe8be8a87bd22e8372cf4d013ea" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sat Apr 25 13:06:34 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 12:37:19 2026 -0700" }, "message": "Add sk_FOO_sort_and_dedup\n\nChange-Id: I5021af1485faebbe664841a2927bf178c8a9cafd\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94028\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "4d124cf20d9fdfe8be8a87bd22e8372cf4d013ea", "tree": "b62a6bcdf5e79df97ab60eec164029dae7a19df8", "parents": [ "0d88d522d05ab9e6a22d8bc5bb8804342e10981c" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Mon Apr 27 18:30:21 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 12:21:06 2026 -0700" }, "message": "Update documentation for ML-KEM\n\nChange-Id: Ia812327af10235de099f5ed2e5dfc6586a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94167\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "0d88d522d05ab9e6a22d8bc5bb8804342e10981c", "tree": "bbb5ff624122c617f46d8af0c58b0c7d016ff326", "parents": [ "1cd09944cf1db4df349dd74cd9116ce8841a9ed4" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Apr 27 00:42:34 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 09:59:07 2026 -0700" }, "message": "pregenerate: Compile public headers entirely as C.\n\nAfter I43281918d498a0c78292d12c01a6df5233938228, we essentially already\nare doing that - however let\u0027s also tell the compiler to slightly\nsimplify things a bit more.\n\nThe only catch is that in C mode, functions become `static inline` in C\nwhen they\u0027d be `inline` (and thus get weak linker symbols) in C++.\n\nSimplifies compilation a bit more (on my system down from 6.40s to\n6.30s user time), but the primary win is consistency.\n\nNote that in case this ever misses a symbol, audit-symbols.go being run\non CQ will flag it. As a corollary, that this change passes CQ without\n`prefix-symbols.h` changing is evidence for its correctness.\n\nChange-Id: If23753cb482268466ee52ce3d39665b66a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/94127\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "1cd09944cf1db4df349dd74cd9116ce8841a9ed4", "tree": "f643cdc4904f92a9859be411ac9093652521c5c5", "parents": [ "cb507bdcf955b12b20b1c34941c573a53d5e5504" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Fri Apr 24 23:36:11 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 08:36:45 2026 -0700" }, "message": "Reject trailing data in ClientHello and EncryptedExtensions trust_anchors\n\nBug: 505803427\nChange-Id: Ia88e6a12de7ceefad686336272447789b4ecffe3\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93969\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "cb507bdcf955b12b20b1c34941c573a53d5e5504", "tree": "6c36fc4324680bae73497c1bdbc5f69a0e1f2cf1", "parents": [ "e93c8fdc6d7ba9808108d4b3c7ff4deda500b513" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Fri Apr 24 23:29:18 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 08:36:40 2026 -0700" }, "message": "Test trailing data in OCSP staple parsing\n\nDECODE_ERROR vs ERROR_PARSING_EXTENSION is a bit of a mess here. If we\ntry to align this one, then RejectEmptyOCSPResponse starts differing\nbecause of how TLS 1.2 and TLS 1.3 deliver OCSP differently. Ah well. I\nleft it alone for now.\n\nBug: 505803427\nChange-Id: I9539692500aab356f946f839c5a651534b80f98b\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93968\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "e93c8fdc6d7ba9808108d4b3c7ff4deda500b513", "tree": "140d4b48dc8c87b437e7ff9a14f4fd0252c38af8", "parents": [ "c70aca77406410ff5fe76f8fdf07386024ce0099" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Fri Apr 24 23:20:02 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 27 08:27:24 2026 -0700" }, "message": "Test trailing data for SNI parsing\n\nThis wires up the trailing data tests to TLS 1.2 ServerHello and TLS 1.3\nEncryptedExtensions. In doing so, fix some missing error queue pushes.\n\nBug: 505803427\nChange-Id: I28c68e8219c181f4e20cd87fc325bff731d38d62\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93967\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" } ], "next": "c70aca77406410ff5fe76f8fdf07386024ce0099" }