)]}'
{
  "commit": "3a1b7306ac18110024f1b716c2aa61f17732e02a",
  "tree": "c32a83fd467d15a480d17ed4169858f0d6553206",
  "parents": [
    "e8f57ca134ffd297e5c46505c86ff7001ef32f7b"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Tue Nov 29 18:44:46 2022 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Fri Dec 02 19:45:36 2022 +0000"
  },
  "message": "Don\u0027t allow the caller to configure invalid signature algorithms.\n\nIt should not be possible to make BoringSSL request unknown signature\nalgorithms, or the special SSL_SIGN_RSA_PKCS1_MD5_SHA1 value, in the\nClientHello or CertificateRequest.\n\nUpdate-Note: This CL makes unknown values fail\nSSL_set_verify_algorithm_prefs, etc. SSL_SIGN_RSA_PKCS1_MD5_SHA1 is\nsilently dropped from the list, rather than an error because, although\ndocumented as incorrect, this hole in the abstraction seems to be\nconfusing. I think there\u0027s some code in Chromium which accidentally puts\nit in the signing prefs (wrong but harmless) and I often need to explain\nto folks that it doesn\u0027t belowing in verify prefs (puts it in the\nClientHello). This makes us tolerate the value by ignoring it.\n\nThis makes the previous pkey_supports_algorithm change moot because we\u0027d\nnever get that far with SSL_SIGN_RSA_PKCS1_MD5_SHA1, but I think the\ncheck, but I think the check belongs in that function too.\n\nThe test also reveals that some of our tests have been accidentally\npassing zero into the preference list all this time.\n\nChange-Id: I76d4eb98682515c3b819e0ed8d44f2d708a98975\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/55446\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "13a7d9a7c2848254f4a293a2c5b26c1d62117764",
      "old_mode": 33188,
      "old_path": "ssl/ssl_privkey.cc",
      "new_id": "a9f92b61b66ed41f8623805b347f4bdf3b5db4ae",
      "new_mode": 33188,
      "new_path": "ssl/ssl_privkey.cc"
    },
    {
      "type": "modify",
      "old_id": "51366a4fdf73041abd69184fef6bbc99ee5554db",
      "old_mode": 33188,
      "old_path": "ssl/ssl_test.cc",
      "new_id": "8e2e5e74d39cb46f2c054680d5709db966088b19",
      "new_mode": 33188,
      "new_path": "ssl/ssl_test.cc"
    },
    {
      "type": "modify",
      "old_id": "fbfbdd9563b2a31055fca041dbad9f0800ea2bca",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/handshake_messages.go",
      "new_id": "b253b0c849310b4109bffc84844eab046e2632fe",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/handshake_messages.go"
    },
    {
      "type": "modify",
      "old_id": "e3c58aa206f45ceaeae4d15392abf67c3ef2a4af",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/runner.go",
      "new_id": "b66ae525df852ed192c0c7906c421721020d0811",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/runner.go"
    }
  ]
}