)]}'
{
  "commit": "fdc425e3eb90e220c55455f746975ff87ee8dc90",
  "tree": "d537081e2ee07cca0261e7bc40b57cf6459ccbf4",
  "parents": [
    "d8394c58b8d7e9497c7a3ad42756d5adf67e77c6"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sun Sep 13 20:05:19 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Oct 22 12:11:57 2026 -0700"
  },
  "message": "Check extensions on the trust anchor too\n\nThis gets most of trust anchor extension enforcement. I believe the only\nthing remaining is how much of policy validation should look at the\ntrust anchor. (I\u0027ll need to remind myself of the quirks of RFC 5937 and\nthe place libpki opted to diverge.)\n\nUpdate-Note: Critical extensions, EKU, and path length constraints are\nnow checked on the trust anchor, the same as if they were on an\nintermediate. This aligns with OpenSSL, except that OpenSSL has some\nextra quirks around the EKU check, that we for now do not replicate.\n\nBug: 525688038\nChange-Id: I0a3cf64a81e44c3637e8050cce97aefa4235c320\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104309\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "194b0b5eb75e18fc833b323dba6c3b223f74aadf",
      "old_mode": 33188,
      "old_path": "crypto/x509/policy.cc",
      "new_id": "534ac007688542516b6f846f1a6118039772a91a",
      "new_mode": 33188,
      "new_path": "crypto/x509/policy.cc"
    },
    {
      "type": "modify",
      "old_id": "4ad0bac748da7b6754a42546e5055068d391ae80",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "054bde5d8d737ef1cf62dac5163913ef2d0dd822",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "c6c31125be28bd5bed9dc56d9e1e0bd42a478938",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.cc",
      "new_id": "d8a84528bb8b0d1f959f9f1712d8b7fec2dff410",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.cc"
    }
  ]
}