)]}'
{
  "commit": "34a1d37575e64c0bc247572d881170ae631fe1b8",
  "tree": "66d543b7aabfba692d15d141b7e3c0c1598de652",
  "parents": [
    "78ee3da2576d9c84ac11fb9cee4d365e8f42e9dc"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon Apr 07 11:15:37 2025 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Apr 14 13:44:28 2025 -0700"
  },
  "message": "Implement functions to generate CMS external signatures\n\nThis implements just the small subset of OpenSSL\u0027s CMS API to support\nthe Linux kernel\u0027s sign-file.c tool. It is nowhere close to a full CMS\nimplementation and is not intended to become one. In particular, it does\nnot implement enough of CMS to support S/MIME. That requires much, much\nmore infrastructure than was implemented here.\n\nCMS is, like PKCS#7, an over-engineered and cryptographically unsound\nset of nestable combinators to support just about any configuration of\ncryptographic operations. Profiling CMS down to a usable subset is, as a\nresult, more complicated, more risky, and less efficient than just\ndesigning a bespoke structure for your use case. It is derived from\nPKCS#7, and largely overlaps. However, both PKCS#7 and CMS use the v1\nversion number, but CMS made incompatible changes in some corner cases\nthat, so far, do not matter to us. (It is incompatible if you try to\nlayer SignedData atop another combinator, where the lack of proper\ndomain separation in this badly designed format is of extra risk.)\n\nIn the case of the kernel, sign-file.c wants an \"external signature\",\nwhich is when the data to be signed lives elsewhere. This is, as a\nresult, a very, very inefficient way to concatenate an enum with a byte\nstring. But this is what the kernel chose, so here we are.\n\nBecause PKCS#7 and CMS are broadly the same structure, I\u0027ve generalized\nthe internal PKCS#7 function rather than duplicating all this code. If\nwe ever hit the cases where PKCS#7 and CMS v1 are incompatible, plumbing\nan extra boolean will be the least of our worries.\n\nTest data was generated by compiling the actual sign-file.c against\nOpenSSL and saving the output.\n\nChange-Id: Idb0874d2b5294bfad564f3a00458c3fd044d9da5\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/78452\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "567d72a092705dd5362eab735f7b4e953ef041ea",
      "old_mode": 33188,
      "old_path": "build.json",
      "new_id": "cbe98b440d157dc61fec84c04e74e84731353cd2",
      "new_mode": 33188,
      "new_path": "build.json"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b2f19532b5f6aa13e19506f58bea5d9d723dccce",
      "new_mode": 33188,
      "new_path": "crypto/cms/cms.cc"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "9f5780fcfa20242bfac018e2428ae7016f3fc927",
      "new_mode": 33188,
      "new_path": "crypto/cms/cms_test.cc"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "68b6e951aef36b048c2dc7ca9ae6a5347c0838e3",
      "new_mode": 33188,
      "new_path": "crypto/err/cms.errordata"
    },
    {
      "type": "modify",
      "old_id": "eaf292d64435d15f11705798e383a878a1bd84e7",
      "old_mode": 33188,
      "old_path": "crypto/pkcs7/internal.h",
      "new_id": "e6cc8b5ca7c198f7e70338aec69078280467954e",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/internal.h"
    },
    {
      "type": "modify",
      "old_id": "db225ff085f7b21e62180405119c4a99af80346e",
      "old_mode": 33188,
      "old_path": "crypto/pkcs7/pkcs7.cc",
      "new_id": "2a5a5a7110c4167479f00649699363f0bd5c90b7",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/pkcs7.cc"
    },
    {
      "type": "modify",
      "old_id": "5a767523f52b1d4119cd380d971f5eb60c3aa028",
      "old_mode": 33188,
      "old_path": "crypto/pkcs7/pkcs7_x509.cc",
      "new_id": "e18c4a5c4a7c3d57533a9d3b24f58b51257c66da",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/pkcs7_x509.cc"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "58438a06f42ef5427a9fe87840d44b7136f011df",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/test/sign_sha1.p7s"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "e304a97fa72f09fe0eb9cf2df16ad31ca66c71fb",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/test/sign_sha1_key_id.p7s"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "9cb8746413b7c03d73ca313b8830f3b7b03f729f",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/test/sign_sha256_key_id.p7s"
    },
    {
      "type": "modify",
      "old_id": "3ccad1433f33b1aa4dc2b0e419943c2ead91acd5",
      "old_mode": 33188,
      "old_path": "gen/crypto/err_data.cc",
      "new_id": "f3d8f7c25748376dc82c7962bc94da2e9a6ae075",
      "new_mode": 33188,
      "new_path": "gen/crypto/err_data.cc"
    },
    {
      "type": "modify",
      "old_id": "51240bfafe198bcb39c90c9aa4be53e804ee768c",
      "old_mode": 33188,
      "old_path": "gen/sources.bzl",
      "new_id": "03ce8b8f1e4f780f8e51cbf798b141668031f980",
      "new_mode": 33188,
      "new_path": "gen/sources.bzl"
    },
    {
      "type": "modify",
      "old_id": "74ea3cedf61c7bb2fcadf342c95941baa43ab65c",
      "old_mode": 33188,
      "old_path": "gen/sources.cmake",
      "new_id": "5ae6e0fa1e3318a03b7daba0ddc3a46c41efdd08",
      "new_mode": 33188,
      "new_path": "gen/sources.cmake"
    },
    {
      "type": "modify",
      "old_id": "5e7dc875333cc3c53e77470cb8fe35ccf350d084",
      "old_mode": 33188,
      "old_path": "gen/sources.gni",
      "new_id": "e4079f11b85ce90083f7e154581110ed052ee8d6",
      "new_mode": 33188,
      "new_path": "gen/sources.gni"
    },
    {
      "type": "modify",
      "old_id": "d4a89b9ad8d079b9f3c827134566b41522b72309",
      "old_mode": 33188,
      "old_path": "gen/sources.json",
      "new_id": "8f4e1a4312887b00fd2b6f0cc9d9a2c5ffac6473",
      "new_mode": 33188,
      "new_path": "gen/sources.json"
    },
    {
      "type": "modify",
      "old_id": "54db872b14e9f1ad94da2f30d18acb74e8f9631a",
      "old_mode": 33188,
      "old_path": "gen/sources.mk",
      "new_id": "02effd913be9984b9f222a7a534c84ae31175993",
      "new_mode": 33188,
      "new_path": "gen/sources.mk"
    },
    {
      "type": "modify",
      "old_id": "24725c7ecd1a85da7d0ff28aefdec746b7fe33cf",
      "old_mode": 33188,
      "old_path": "include/openssl/base.h",
      "new_id": "ebbb1cfede75fa4208b2bd6be35bc8715909457e",
      "new_mode": 33188,
      "new_path": "include/openssl/base.h"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "6616348ad96a81d20cd6e0590422b26706ecbef8",
      "new_mode": 33188,
      "new_path": "include/openssl/cms.h"
    },
    {
      "type": "modify",
      "old_id": "8484903c57448f98dd5739152cb4f6dcafb631cc",
      "old_mode": 33188,
      "old_path": "include/openssl/err.h",
      "new_id": "0263505f22901d0dc3e808b0d292723707de0a1d",
      "new_mode": 33188,
      "new_path": "include/openssl/err.h"
    },
    {
      "type": "modify",
      "old_id": "d06f7d00c1f7abc09275c6c8de0005e9988fe5d4",
      "old_mode": 33188,
      "old_path": "include/openssl/opensslconf.h",
      "new_id": "7249fdcba3ba8f849e3339c0e1fe48eb48c017a9",
      "new_mode": 33188,
      "new_path": "include/openssl/opensslconf.h"
    },
    {
      "type": "modify",
      "old_id": "e88bef99ca81d2111fa7be6f37867c70640c3605",
      "old_mode": 33188,
      "old_path": "util/pregenerate/err_data.go",
      "new_id": "8eb1a066d64e34c0376a1cdb66dc7352e91a32c1",
      "new_mode": 33188,
      "new_path": "util/pregenerate/err_data.go"
    }
  ]
}