| commit | b083a69e5b9a38fcbae710b0c2081de0235d509b | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Tue Dec 19 17:43:14 2023 -0500 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Wed Dec 20 20:58:06 2023 +0000 |
| tree | 86e448cb5915b39356969eeeeae5e75748507b42 | |
| parent | b3cda5cf4549b131b09e6fc67775717dcfeeae13 [diff] |
Remove X509_STORE_set_get_issuer This is unused. Removing it removes a codepath where callers may inadvertently break internal invariants of the verifier. It also removes an attractive nuisance: pyca/cryptograpy at one point intended to use this callback for AIA fetching. They are lucky they never did because that would have been a security bug. Certificates returned by this callback are "trusted" which means, if they satisfy the X509_TRUST criteria (e.g. are self-signed), they would become trust anchors! Also remove the getters for the callbacks, as no one is using them. Not much good can be done by extracting callbacks. Either it is your X509_STORE, in which case you know your own callbacks, or it is someone else's, in which case it probably depends on some application-specific state that you don't know about. Update-Note: Removed a handful of unused functions. Change-Id: Ic95db40186a9107e2a3f44028aa28a335653c25a Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64987 Commit-Queue: Bob Beck <bbe@google.com> Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: