)]}'
{
  "commit": "bbbeba2e6676800b75d073c72ea8da5bacc9d7f8",
  "tree": "9417826140cd04080a041b77b530274d90ff3e4e",
  "parents": [
    "a74aca089d08328744c3f22b240d160b44d40e02"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sun Sep 13 14:36:48 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Tue Oct 20 12:07:36 2026 -0700"
  },
  "message": "Rewrite the path builder\n\nThe old path builder was a mess. It would collect certificates until it\nhit a self-signed certificate, or failed, and then it would go back and\ncheck after the fact if it found a trust anchor.\n\nThis meant that, in a variety of edge cases, the path would extend\nbeyond the trust anchor. Rework all this to match how X.509 is actually\nmeant to work. We append to the chain, evaluating trust in the\nnewly-appended certificate. If it\u0027s a trust anchor, we stop.\n\nMaintain the invariant from before where we will always append untrusted\ncertificates, followed by store certificates, and not interleave them.\n(Otherwise last_untrusted is broken. We also should remove the\nlast_untrusted variable, but that\u0027s a separate bug.)\n\nThis is still not a backtracking path-builder, but at least it doesn\u0027t\ngive incoherent answers.\n\nIn doing so, the function evaluating whether we have a trust anchor is\ncleaned up. This fixes some of the weird cases around the target\ncertificate being in the trust store. (See updated unit tests.)\n\nUpdate-Note: X509_verify_cert is reworked to have many downright buggy\nbehaviors fixed. In particular, it will now stop building the path at a\ntrust anchor. This matches modern OpenSSL behavior and how X.509 is\nmeant to work. We\u0027ve also qualified this against tests at Google. But if\nsomething breaks around certificate verification, let us know.\n\nFixed: 548461146\nChange-Id: I1b963f034d6b778d218bc736b1a2dc3e6bed4fa0\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/103863\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "874d0d1fde11c01a13e868d89c4e949a2a9233c8",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "529a3f08b9c0caf620870520499d17ff6e06d406",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "af2f75d509b6abe14cc35027e1cbb201368052ac",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.cc",
      "new_id": "f2ddaef5a8ed880934ca11ad26c4a9d0f17846d0",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.cc"
    },
    {
      "type": "modify",
      "old_id": "9542a89b3cddcc0ca7641f35f11bc59b5e7dd54c",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "cc2459a099a99d01a03d510178dddb6544a226c6",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    }
  ]
}