)]}'
{
  "commit": "1264f0ce35d548cf3fd947149b1a82059e3a4955",
  "tree": "92f6d1812fbdd57039bf53d17f404346a4b937d5",
  "parents": [
    "94a63a5b6e883b3cec48f0765b38ae36b807e4f8"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon May 03 15:05:58 2021 -0400"
  },
  "committer": {
    "name": "Adam Langley",
    "email": "agl@google.com",
    "time": "Tue May 04 22:22:26 2021 +0000"
  },
  "message": "Correctly order PKCS#7 certificates and CRLs.\n\nPKCS#7 stores certificates and CRLs in (implicitly-tagged) SET OF\ntypes. This means they\u0027re unordered and, in DER, must be sorted.\n\nWe currently sort neither. OpenSSL upstream sorts CRLs but doesn\u0027t sort\ncertificates. https://github.com/openssl/openssl/pull/13143 reports that\nMicrosoft has a stricter parser that checks this. This CL fixes both\nfields in our serializer.\n\nThis does not change the parsing code, which still preserves whatever\norder we happened to find, but I\u0027ve updated the documentation to clarify\nthat callers should not rely on the ordering.\n\nBased on [0] and the odd order in kPKCS7NSS, I believe this aligns with\nNSS\u0027s behavior.\n\nUpdate-Note: It is no longer the case that constructing a PKCS#7 file\nand parsing them back out will keep the certificates and CRLs in the\nsame order.\n\n[0] https://source.chromium.org/chromium/chromium/src/+/main:chrome/common/net/x509_certificate_model_nss_unittest.cc;drc\u003dc91b0c37b5ddf31cffd732c661c0c5930b0740f4;l\u003d286\n\nChange-Id: If776bb78476557af2c4598f1b6dc10e189adab5d\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/47304\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "948b44f907e459de460250f9938d246016c0f78b",
      "old_mode": 33188,
      "old_path": "crypto/pkcs7/pkcs7_test.cc",
      "new_id": "8e146036c6ed066b1b8a51a520c93c8b6725efe7",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/pkcs7_test.cc"
    },
    {
      "type": "modify",
      "old_id": "5afd28b76c0544e6526cfbf56c54fee672ee9b9c",
      "old_mode": 33188,
      "old_path": "crypto/pkcs7/pkcs7_x509.c",
      "new_id": "3f1526c27360b3231d98ebdb65c469f0d15bdee4",
      "new_mode": 33188,
      "new_path": "crypto/pkcs7/pkcs7_x509.c"
    },
    {
      "type": "modify",
      "old_id": "d2d642ae0449763f9247a06ff02298243fd01454",
      "old_mode": 33188,
      "old_path": "include/openssl/pkcs7.h",
      "new_id": "8f2a885927fae282b38a2a083b3c30083f18cfdd",
      "new_mode": 33188,
      "new_path": "include/openssl/pkcs7.h"
    }
  ]
}