)]}'
{
  "commit": "8f5eb80b810ff63d14ad3535cb16f7cb8271a4f5",
  "tree": "d15b19c6355548a40e5cbe87cab65ffc792135e2",
  "parents": [
    "2bde9365fac1da341d7bfa504f032aa3e50a8653"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri Oct 01 16:40:31 2021 -0400"
  },
  "committer": {
    "name": "Adam Langley",
    "email": "agl@google.com",
    "time": "Fri Oct 01 22:11:55 2021 +0000"
  },
  "message": "Enable X509_V_FLAG_TRUSTED_FIRST by default.\n\nThe OpenSSL X.509 verifier lacks a proper path builder. When there are\ntwo paths available for a certificate, we pick one without looking at\nexpiry, etc.\n\nIn scenarios like one below, X509_V_FLAG_TRUSTED_FIRST will prefer\nLeaf -\u003e Intermediate -\u003e Root1. Otherwise, we will prefer\nLeaf -\u003e Intermediate -\u003e Root1Cross -\u003e Root2:\n\n             Root2\n               |\n Root1     Root1Cross\n    \\         /\n    Intermediate\n         |\n       Leaf\n\nIf Root2 is expired, as with Let\u0027s Encrypt, X509_V_FLAG_TRUSTED_FIRST\nwill find the path we want. Same if Root1Cross is expired. (Meanwhile,\nif Root1 is expired, TRUSTED_FIRST will break and leaving it off works.\nTRUSTED_FIRST does not actually select chains with validity in mind. It\njust changes the semi-arbitrary decision.)\n\nOpenSSL 1.1.x now defaults to X509_V_FLAG_TRUSTED_FIRST by default, so\nmatch them. Hopefully the shorter chain is more likely to be correct.\n\nUpdate-Note: X509_verify_cert will now build slightly different chains\nby default. Hopefully, this fixes more issues than it causes, but there\nis a risk of trusted_first breaking other scenarios. Those scenarios\nwill also break OpenSSL 1.1.x defaults, so hopefully this is fine.\n\nBug: 439\nChange-Id: Ie624f1f7e85a9e8c283f1caf24729aef9206ea16\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/49746\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Ryan Sleevi \u003crsleevi@chromium.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "39a9d0d47f8d4ae47a853afd331e68fbdd06afe7",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "8878030cfa9939c961de6c2e03d2d38a45920ca4",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "5a881d64c30076404cc800fff9e943bb0b30d2ac",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vpm.c",
      "new_id": "29d5341efc8eb7ae6f90bdde5a8032e99f75c98e",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vpm.c"
    }
  ]
}