tree 86e448cb5915b39356969eeeeae5e75748507b42
parent b3cda5cf4549b131b09e6fc67775717dcfeeae13
author David Benjamin <davidben@google.com> 1703025794 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1703105886 +0000

Remove X509_STORE_set_get_issuer

This is unused. Removing it removes a codepath where callers may
inadvertently break internal invariants of the verifier.

It also removes an attractive nuisance: pyca/cryptograpy at one point
intended to use this callback for AIA fetching. They are lucky they
never did because that would have been a security bug. Certificates
returned by this callback are "trusted" which means, if they satisfy the
X509_TRUST criteria (e.g. are self-signed), they would become trust
anchors!

Also remove the getters for the callbacks, as no one is using them. Not
much good can be done by extracting callbacks. Either it is your
X509_STORE, in which case you know your own callbacks, or it is someone
else's, in which case it probably depends on some application-specific
state that you don't know about.

Update-Note: Removed a handful of unused functions.

Change-Id: Ic95db40186a9107e2a3f44028aa28a335653c25a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64987
Commit-Queue: Bob Beck <bbe@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>