)]}'
{
  "commit": "d8394c58b8d7e9497c7a3ad42756d5adf67e77c6",
  "tree": "4350b8eb0a4ee5a3e749c428c59a922c19cab9d8",
  "parents": [
    "1cd9d22abadac16cdb53e58cf925019502463ead"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sun Sep 13 19:51:13 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Oct 22 12:11:47 2026 -0700"
  },
  "message": "Check extensions for X509_STORE certificates that aren\u0027t trust anchors\n\nOpenSSL\u0027s path builder is odd. Typically one builds a path with:\n\n- Target certificate\n- Intermediates\n- Trust anchor\n\nBut OpenSSL has:\n\n- Target certificate\n- \"Untrusted\" intermediates\n- \"Trusted\" intermediates\n- Trust anchor\n\n\"Trusted\" intermediates come from the X509_STORE, but are not trust\nanchors. They were functionally equivalent to \"untrusted\" intermediates,\nin that you still have to chain up to a trust anchor. But some checks\napply differently (the last_untrusted field).  Historically, these\ncertificates didn\u0027t check critical extensions, key usage, etc.\n\nAs this is confusing and not a state supported by RFC 5280, stop\ntreating them funny. OpenSSL stopped doing this in 1.1.0 I believe. This\nremoves the need to track last_untrusted and removes the distinction\nbetween \"untrusted\" and \"trusted\" intermediates.\n\nUpdate-Note: Critical extensions, key usages, and path length\nconstraints will no longer be ignored for intermediate certificates\npicked up from the X509_STORE. This is not expected to impact anyone,\nand brings us closer to where upstream OpenSSL is now.\n\nFixed: 526486357\nChange-Id: Ie597d79e9eb2f716f49b846a5cea806d92d89c43\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104308\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "967378f24f6fa70e45a4081db565744ce277f82d",
      "old_mode": 33188,
      "old_path": "crypto/x509/internal.h",
      "new_id": "ab44a62327e5eae2b9bf23fdb7b432b46e720ed0",
      "new_mode": 33188,
      "new_path": "crypto/x509/internal.h"
    },
    {
      "type": "modify",
      "old_id": "48fb4d35e6e39e1fcacc96fa780bb3fc01048741",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "4ad0bac748da7b6754a42546e5055068d391ae80",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "678f685b19dbfdfa0ee0670bd8f3bd8943c83676",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.cc",
      "new_id": "c6c31125be28bd5bed9dc56d9e1e0bd42a478938",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.cc"
    }
  ]
}