)]}'
{
  "commit": "b251d813ec615e7ef01d82073f94960eb13b1e0a",
  "tree": "5d5bc16150c84a6f02f9827e80120cfab98267ab",
  "parents": [
    "23d58423169a2d473a6028228e46f68d1e65f503"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon Dec 11 01:18:00 2023 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Dec 14 18:17:25 2023 +0000"
  },
  "message": "Change certificate depth limit to match OpenSSL and document\n\nOpenSSL 1.1.0 included d9b8b89bec4480de3a10bdaf9425db371c19145b, which a\ncleanup change to X509_verify_cert. This cleanup changed the semanitcs\nof the depth limit. Previously, the depth limit omitted the leaf but\nincluded the trust anchor. Now it omits both.\n\nWe forked a little before 1.0.2, so we still had the old behavior. Now\nthat the new behavior is well-established, switch to new one. Bump\nBORINGSSL_API_VERSION so callers can detect one or the other as needed.\n\nDocument the new semantics. Also fix up some older docs where I implied\n-1 was unlimited depth. Negative numbers were actually enforced as\nnegative numbers (which means only explicitly-trusted self-signed certs\nworked).\n\nUpdate-Note: The new semantics increase the limit by 1 compared to the\nold ones. Thus this change should only accept more chains than\npreviously and be relatively safe. It also makes us more\nOpenSSL-compatible. Envoy will need a tweak because they unit test the\nboundary condition for the depth limit.\n\nBug: 426\nFixed: 459\nChange-Id: Ifaa108b8135ea3d875f2ac1f2a3b2cd8a22aa323\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64707\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b277eb0dba9cb7192ba13fa653e86a64e2e9b5c3",
      "old_mode": 33188,
      "old_path": "crypto/x509/internal.h",
      "new_id": "cc40ee538c975a3a8ae836eda5457cac58690b60",
      "new_mode": 33188,
      "new_path": "crypto/x509/internal.h"
    },
    {
      "type": "modify",
      "old_id": "a590e087691f7fae4540499301e88285980279eb",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "ab8ef7f65550db0b4ac9dcf4d884a615011af4bd",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "090ed033a9c272f13ea159edbeca6098769adf82",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.c",
      "new_id": "9b013883c670326898c2fe1b119dcdbd085bea57",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.c"
    },
    {
      "type": "modify",
      "old_id": "f0981b8b7881eb9b1a1f2d2e42ec92f688a4997f",
      "old_mode": 33188,
      "old_path": "include/openssl/base.h",
      "new_id": "9a47321bdd723f682aee224d50dcaac14b5915ee",
      "new_mode": 33188,
      "new_path": "include/openssl/base.h"
    },
    {
      "type": "modify",
      "old_id": "f1d4eb06629fa53e37fceb5ac0b9716de461afe5",
      "old_mode": 33188,
      "old_path": "include/openssl/ssl.h",
      "new_id": "ab6225e9e61aa9096c62b5608d0655b18cf7ee1f",
      "new_mode": 33188,
      "new_path": "include/openssl/ssl.h"
    },
    {
      "type": "modify",
      "old_id": "852a96f5e99e72391250d8237384de4e2bf62da0",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "b27c97d331b13e47d005dc0b3ab03aa590ac35dd",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    }
  ]
}