)]}'
{
  "commit": "96c24252244ef72967cc052bbbcafacb4509a87a",
  "tree": "4194a75e226597e9a66b00c93249ff7c063bc783",
  "parents": [
    "b402cff383c5d150bc69d9c5c0d9288d718caf5b"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Wed Aug 13 17:54:15 2025 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Aug 28 10:03:48 2025 -0700"
  },
  "message": "Introduce EVP_PKEY_ALG\n\nThis adds new SPKI and PKCS#8 parser entrypoints that pass in the list\nof allowed algorithms. Algorithms are expressed as EVP_PKEY_ALG\nfunctions and roughly things that can create EVP_PKEYs in various ways.\n(Right now just SPKI and PKCS#8 parsers, but I\u0027m imagining that they\u0027ll\nalso be the handle for the \"raw\" public/private key parsers and things\nlike the list of curves for ECPrivateKey or X9.62 points.)\n\nThe immediate motivation is to give a handle for opting into\nEVP_PKEY_RSA_PSS (we don\u0027t want most applications to be exposed to\nthose), but I\u0027m hoping this can also:\n\n- Let us add legacy or experimental algorithms for one caller without\n  worrying about exposing all callers to them.\n\n- Let size-constrained applications use EVP without worrying about\n  binary size.\n\n- Reduce the need for people to check the key type after parsing keys. I\n  would like to it eliminate the need, but RSA having a continuum of\n  sizes makes things tricky. For now, EVP_pkey_rsa() just accepts all\n  supported RSA sizes (512 through 8192, but hopefully we can clamp it\n  down).\n\nWhile we\u0027re here, correct what, in hindsight, were I think some missteps\nin the EVP_parse_public_key convention:\n\n- Not saying the name of the format in the function name. Since I expect\n  we\u0027ll add EVP_PKEY_from_ec_private_key, EVP_PKEY_from_rsa_private_key,\n  etc., functions to start filling out EVP, having the name of the\n  format would have been nice.\n\n- Taking an in/out CBS parameter. As an in/out parameter, we don\u0027t check\n  trailing data and just pass it to the caller to check. This optimized\n  for parsing an SPKI inside a structure, rather than standalone. In\n  practice, folks forget to check trailing data.\n\nIn comparison to OpenSSL 3.x, I think an EVP_PKEY_ALG is roughly an\nOSSL_KEYMGMT, but that\u0027s a very confusing name. Maybe also with bits of\nthe OSSL_DECODER in there. Mostly I don\u0027t understand their very\ncomplicated (and apparently quadratic-time) decoder system.\n\nOpenSSL 3.x also has an OSSL_LIB_CTX which has been threaded into a\nbunch of objects. Having BoringSSL\u0027s OSSL_LIB_CTX carry a list of these\nthings would be plausible, but different call sites within a single\napplication may support different algorithms, so let\u0027s start with the\nexplicit list approach and see where we go from there.\n\nBug: 42290364\nChange-Id: I342603efdc167c8f587357d17800d7ad545d5908\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/81651\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7fca9b89f1e79e1936e1b58127a9fdff425bacb8",
      "old_mode": 33188,
      "old_path": "crypto/evp/evp_asn1.cc",
      "new_id": "1f5216f21e90c5447f3018fe40cba2594e28908c",
      "new_mode": 33188,
      "new_path": "crypto/evp/evp_asn1.cc"
    },
    {
      "type": "modify",
      "old_id": "f69ccbe1933f803b3e900d77f32587454e351650",
      "old_mode": 33188,
      "old_path": "crypto/evp/evp_extra_test.cc",
      "new_id": "bd0b648b7e132e640fad4346e135e95556201dd0",
      "new_mode": 33188,
      "new_path": "crypto/evp/evp_extra_test.cc"
    },
    {
      "type": "modify",
      "old_id": "2df9cc42b0b23d74e7912f8019cec9ccc534355f",
      "old_mode": 33188,
      "old_path": "crypto/evp/evp_test.cc",
      "new_id": "25af7edb10f19c64badaf508cc2c18cc6c2cd5c5",
      "new_mode": 33188,
      "new_path": "crypto/evp/evp_test.cc"
    },
    {
      "type": "modify",
      "old_id": "ff6ead3404da18d2ebd1d2c4748731ab7d6d8a6f",
      "old_mode": 33188,
      "old_path": "crypto/evp/internal.h",
      "new_id": "9ceb6f70562b18a1ccaee5f73192f3dfdf3105f4",
      "new_mode": 33188,
      "new_path": "crypto/evp/internal.h"
    },
    {
      "type": "modify",
      "old_id": "237b34bdb89462c141281a6a409c14a8d7f94b5d",
      "old_mode": 33188,
      "old_path": "crypto/evp/p_dsa_asn1.cc",
      "new_id": "04c21fe3c8f2310d35da773fa7de5e9843848564",
      "new_mode": 33188,
      "new_path": "crypto/evp/p_dsa_asn1.cc"
    },
    {
      "type": "modify",
      "old_id": "10bde92e31dbb5ff2735be85924a67fae8ec87a8",
      "old_mode": 33188,
      "old_path": "crypto/evp/p_ec_asn1.cc",
      "new_id": "c5a24fa424c25032b81211b05ceb971bf4fc352a",
      "new_mode": 33188,
      "new_path": "crypto/evp/p_ec_asn1.cc"
    },
    {
      "type": "modify",
      "old_id": "6f1f572edde74e4da67970c6f2eaf3a49d2ab893",
      "old_mode": 33188,
      "old_path": "crypto/evp/p_ed25519_asn1.cc",
      "new_id": "cdd05ba0eba23a7c152a38956abad805ad6e2b3f",
      "new_mode": 33188,
      "new_path": "crypto/evp/p_ed25519_asn1.cc"
    },
    {
      "type": "modify",
      "old_id": "ab2350894fbc05df285ffefb008836e4e5d3544d",
      "old_mode": 33188,
      "old_path": "crypto/evp/p_rsa_asn1.cc",
      "new_id": "6a64d399b34d05206d566ae943c07bcac628772a",
      "new_mode": 33188,
      "new_path": "crypto/evp/p_rsa_asn1.cc"
    },
    {
      "type": "modify",
      "old_id": "f37111ca0c6c42d60050802411628ec7184e97a7",
      "old_mode": 33188,
      "old_path": "crypto/evp/p_x25519_asn1.cc",
      "new_id": "49e65efdd671ae7a0c253146e5d21430c65b839d",
      "new_mode": 33188,
      "new_path": "crypto/evp/p_x25519_asn1.cc"
    },
    {
      "type": "modify",
      "old_id": "b15fda597726d40a928aef1112f8d53ad33f50e0",
      "old_mode": 33188,
      "old_path": "crypto/evp/test/ec_tests.txt",
      "new_id": "78b49b7ac0823e6f34faeba8fc7ad1947d4b20b2",
      "new_mode": 33188,
      "new_path": "crypto/evp/test/ec_tests.txt"
    },
    {
      "type": "modify",
      "old_id": "5b0b21614edaa2bb56ebd398a5a7c26e94d08a44",
      "old_mode": 33188,
      "old_path": "crypto/evp/test/ed25519_tests.txt",
      "new_id": "56b23ab16ee5fea3e2996fd1be527633850c7e3d",
      "new_mode": 33188,
      "new_path": "crypto/evp/test/ed25519_tests.txt"
    },
    {
      "type": "modify",
      "old_id": "820f1d8e90e958d35352aa79fd528d6107222cc8",
      "old_mode": 33188,
      "old_path": "crypto/evp/test/evp_tests.txt",
      "new_id": "f6b15b8ff0d7899c5de071033de2cb62e60a547f",
      "new_mode": 33188,
      "new_path": "crypto/evp/test/evp_tests.txt"
    },
    {
      "type": "modify",
      "old_id": "4e28c86d5374902009c6a88302df12411c59d847",
      "old_mode": 33188,
      "old_path": "crypto/evp/test/rsa_tests.txt",
      "new_id": "902db0fe3ca8abd9309126dcc121510a9e430d74",
      "new_mode": 33188,
      "new_path": "crypto/evp/test/rsa_tests.txt"
    },
    {
      "type": "modify",
      "old_id": "9e9690aaf8c3684b12d4a216af5d2b82577df872",
      "old_mode": 33188,
      "old_path": "crypto/evp/test/x25519_tests.txt",
      "new_id": "96dbbf72f7f9ad69adf9fdfc1644eda495201b41",
      "new_mode": 33188,
      "new_path": "crypto/evp/test/x25519_tests.txt"
    },
    {
      "type": "modify",
      "old_id": "95cc15df18f8f35ec19a2ce9d77a4154ace5a2db",
      "old_mode": 33188,
      "old_path": "include/openssl/base.h",
      "new_id": "ae422d51c112c95d8d5404f93881f01bf35e4ae6",
      "new_mode": 33188,
      "new_path": "include/openssl/base.h"
    },
    {
      "type": "modify",
      "old_id": "260db82e6955adbb35653f41b067a72f3c4a8c97",
      "old_mode": 33188,
      "old_path": "include/openssl/evp.h",
      "new_id": "73ca73f5e698c620d67b51af4d887a0a655db1fc",
      "new_mode": 33188,
      "new_path": "include/openssl/evp.h"
    }
  ]
}