)]}'
{
  "commit": "c2b7df5850398dc7c73146c07f6eed95dd363a48",
  "tree": "37d600a8bcd7cf4234a8155018c85fc5f4b063fe",
  "parents": [
    "1685bd140f6eeb6939c73756be70c888dde32c5e"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sat Nov 18 19:31:24 2023 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Nov 27 16:59:32 2023 +0000"
  },
  "message": "Add X509_OBJECT_new and X509_OBJECT_free\n\nThis is a bit of a mess. The immediate motivation here is that there is\nno legitimate reason to ever call X509_OBJECT_free_contents outside of\nthe library. Unsurprisingly, this means rust-openssl uses it.\n\nrust-openssl uses it because they want to be able to free X509_OBJECTs.\nAdd OpenSSL 1.1.x\u0027s X509_OBJECT_free, which is what they should be using\nit instead. As it turns out, they don\u0027t *actually* need to free\nX509_OBJECTs. This is just some design mistake that cause them to need\nfree functions for types they never free. On top of that, the only\nreason rust-openssl references X509_OBJECT is for\nX509_STORE_get0_objects, but their use of that API is a Rust safety\nviolation anyway. It\u0027s all a mess.\n\nAs for whether freeing it ever makes sense, the question is whether\nX509_STORE_get_by_subject needs to be a public API. In so far as it is\npublic, callers would need to create empty X509_OBJECTs as an output,\nnow that X509_OBJECT is opaque. There are also other users of\nX509_STORE_get0_objects that might benefit from an\nX509_STORE_get1_objects, in which case X509_OBJECT_free will be useful.\n\nFor now just to unblock fixing the more immediate rust-openssl mistake\n(rather than the underlying mistake), add the APIs that\nX509_STORE_get_by_subject callers would need if they existed.\n\nThere\u0027s quite a bit to clean up around X509_OBJECT, but start by adding\nthese APIs.\n\nAs part of this, since rust-openssl prevents us from removing\nX509_OBJECT_free_contents, deprecate it and fix it to leave the\nX509_OBJECT in a self-consistent state. (This is moot because\nrust-openssl will never call it, but still.)\n\nChange-Id: I78708f2d2464eb9a18844fef0d62cb0a727b9f47\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64129\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "814f0ce9bba701016c001bf1d08efd676af71062",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_lu.c",
      "new_id": "d113cee1665d95b395dfd31690e563fd516193a5",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_lu.c"
    },
    {
      "type": "modify",
      "old_id": "df3dd58503c971c5599b35940f9b62856a93fcc6",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "dfe66c514d6c7deb290ae262279861daf45eaeb3",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    }
  ]
}