)]}'
{
  "commit": "defe5810ee8be430bcdeccf46a199bec0e93abdb",
  "tree": "1b98e1fb3a5b0d1f3b016c681d955e695019e518",
  "parents": [
    "da0976d6b8b55bfd2ad446c67cb54113b602085c"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon Aug 10 22:53:26 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Aug 17 09:00:37 2026 -0700"
  },
  "message": "Always enable X509_V_FLAG_TRUSTED_FIRST\n\nNo one seems to ever disable it. This means we can unwind the alt-chains\nlogic, as it\u0027s never used as a result.\n\nAs discussed in\nhttps://boringssl-review.googlesource.com/c/boringssl/+/49746, neither\nmode is really correct. An ideal implementation would be a backtracking\npath builder. But the particular implementation of backtracking in\nalt-chains is both insufficient and particularly messy. Simplify this\nfor now and go from there.\n\nUpdate-Note: X509_V_FLAG_TRUSTED_FIRST is now always enabled. (It was\npreviously a default.) Passing it to X509_VERIFY_PARAM_clear_flags now\ndoes nothing. Running tests suggests no one is relying on this. This\nmeans X509_V_FLAG_NO_ALT_CHAINS is now also a no-op because it does\nnothing when X509_V_FLAG_TRUSTED_FIRST is enabled.\n\nBug: 544895602\nChange-Id: I0b6519f705de2abacea2b6041ae855d59286b631\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100787\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "06a4a160aa4cb0fea23c84497a9dd7356a2b00cc",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "694b6dd430806aeb8dc80f6b088b1878f9f30219",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "ce54dd6bb20c24551007207a5097c651f252ab8d",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.cc",
      "new_id": "fedc4a0d1ded988746c4282d0e780c7e4d8e37ab",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.cc"
    },
    {
      "type": "modify",
      "old_id": "e5b99639addfd98ffe08aa7f5e88fdc7dc80b2b7",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vpm.cc",
      "new_id": "9841ad78476aa01fdfef99c915b5c68143363837",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vpm.cc"
    },
    {
      "type": "modify",
      "old_id": "d08e888b296df81c7da17125f8edd46eea2ff331",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "f1b21e2a95cf27dd376b75123df476217dfa021c",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    },
    {
      "type": "modify",
      "old_id": "2af6aefda35f3762820e761403f65e5c2d8ceedc",
      "old_mode": 33188,
      "old_path": "rust/bssl-x509/src/params.rs",
      "new_id": "afbc2e445cb8caa20a10d98da6762b7b184c4c47",
      "new_mode": 33188,
      "new_path": "rust/bssl-x509/src/params.rs"
    }
  ]
}