)]}'
{
  "commit": "4bc3b8427402f1d142a7f9aeb1a4e418775381b0",
  "tree": "6f1da6c83a58808c568f31779fe6329b359ae0ca",
  "parents": [
    "9e96cc5383e12853cd24cf3442fa691191b2bbf5"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Tue Sep 02 18:49:23 2025 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Wed Sep 03 22:04:05 2025 -0700"
  },
  "message": "Add X509_parse_with_algorithms\n\nThis controls the algorithms that the SPKI will be parsed with. Note\nthere is a decision point here with our API: is an X509 a holder of an\nEVP_PKEY, and thus parsed with algorithms in mind, or is it just an\nabstractly parsed certificate, and algorithms are instead passed to an\nX509_get_publickey_with_algorithms.\n\nThis CL takes the first route, largely because upstream already went\ndown this path in many ways:\n\n- X509_get0_pubkey expose the fact that X509\u0027s retain a cached EVP_PKEY.\n\n- Upstream OpenSSL added X509_new_ex which passes an OSSL_LIB_CTX into\n  the X509. It\u0027s a little unfortunate that this pattern relies on object\n  reuse in d2i_X509, but so it goes.\n\n- A caller using the same X509 to verify mutiple signatures (e.g. a root\n  CA) might wish to hold on to the EVP_PKEY to avoid importing the key a\n  bunch. (This probably doesn\u0027t matter too much, but if we ever add an\n  API to precompute a table to speed up ECDSA verify...)\n\nThis changes follows in those footsteps. Note this means that the same\ncertificate bytes might produce semantically different X509 objects\n(with or without the SPKI in EVP_PKEY form) depending on how it was\nparsed. This is a little unfortunate but probably the most\nstraightforward model given where we are.\n\nBug: 42290364, 384818542\nChange-Id: I8c0c95cb1d3221fc0b79a7749833c4f0d87646eb\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/81787\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4e3a72bca5798c63f5253e450c42c2c9976742d7",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "b0085ed4529efd99c0411f1277e93c22344c0c65",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "520ae639bb1e09049eadc9f509e56ae55adb197f",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_x509.cc",
      "new_id": "442c827ad79fde0374c0f5c1d7177dfdacbfaae6",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_x509.cc"
    },
    {
      "type": "modify",
      "old_id": "2fe11e377653993feab6144d280be3634e7a4212",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "667eede5cb5d252372b4dd1c33a041dead7eb6fd",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    }
  ]
}