)]}'
{
  "commit": "6dcce800371dd5f3cb35a16a18b99fcfadf213ab",
  "tree": "d8eff2c86b444163ec42b38bb0c5cc1e293e1fa8",
  "parents": [
    "f18638cca14d0b02617785e848a5afaa2715f71a"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon Nov 02 18:16:14 2020 -0500"
  },
  "committer": {
    "name": "CQ bot account: commit-bot@chromium.org",
    "email": "commit-bot@chromium.org",
    "time": "Tue Nov 03 23:43:59 2020 +0000"
  },
  "message": "Add functions for manipulating X.509 TBS structures.\n\nWhen generating a signature with some external signing process, the\ncaller needs to fill in the TBSCertificate (including the signature\nalgorithms), serialize the TBSCertificate, and then fill in the\nsignature.\n\nWe have i2d_re_X509_tbs (originally from CT I believe), but there are no\nsetters for the signature algorithms or the signature. Add\nX509_set1_signature_algo, which mirrors upstream\u0027s\nX509_REQ_set1_signature_algo, and X509_set1_signature_value, which is\nnew. Upstream has X509_REQ_set0_signature, but that requires the caller\nmanually assemble an ASN1_BIT_STRING. Taking the byte string seems less\nerror-prone.\n\nAdditionally, add i2d_X509_tbs and i2d_X509_CRL_tbs, for the non-\"re\"\nvariants of those APIs. Conscrypt needs to extract the TBS portion of a\ncertificate and a CRL, to implement X509Certificate.getTBSCertificate()\nand X509CRL.getTBSCertList(). There, the aim is to get the data to\nverify on an existing immutable certificate. OpenSSL has avoided\nexporting the X509_CINF type, which I think is correct, so instead this\nmirrors i2d_re_X509_tbs. (This does mean mirroring the confusing i2d\ncalling convention though.)\n\nThese new functions should unblock getting rid of a bunch of direct\nstruct accesses.\n\nLater on, we should reorganize this header into immutable APIs for\nverification and mutable APIs for generation. Even though we\u0027re stuck\nthe mistake of a common type for both use cases, I think splitting up\nthem up will let us rationalize the caches in the X509 objects a bit.\n\nChange-Id: I96e6ab5cee3608e07b2ed7465c449a72ca10a393\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/43784\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b170b76a725d5895b55fe0dae256c43a5038fa34",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "7c0eeaced331c9d138e0c155b5f14adef1c94ccd",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "b07ff27318cae086009fe87bf4b125e2f7ffa2c6",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509cset.c",
      "new_id": "a5cb3a3d6e44534aafd924599d7ccaec34057874",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509cset.c"
    },
    {
      "type": "modify",
      "old_id": "ab246515e9511b720433c4ed28fd920a7f0466eb",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_x509.c",
      "new_id": "397230cd58f9d8ebc75157680f0e40d9f0d21e1c",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_x509.c"
    },
    {
      "type": "modify",
      "old_id": "38a42197caee082c7b4dfb477e0e6835612be8a4",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "580c591a574cfe21aa88eb8b39c7550ae4e9959b",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    }
  ]
}