)]}'
{
  "commit": "efad2bfc83544bb926921de61baf6f962e685671",
  "tree": "27d6f28485ec0c04bb9eda798e2ebbc7464882dc",
  "parents": [
    "9f376b0694dfb8528fa2200369b48632563e972f"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri Feb 23 14:37:10 2024 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Tue Mar 05 18:03:24 2024 +0000"
  },
  "message": "Fix delegated credential signature algorithm handling\n\nhttps://boringssl-review.googlesource.com/c/34884 tried to update to the\nnewer DC draft, but didn\u0027t quite do so. In that update, DCs\novercomplicated the signature algorithm negotiation so that there are\ntwo different signature algorithm lists, used in different contexts.\n\nThe existing signature_algorithms extension is used to verify the\nsignature *on* the DC, made by the end-entity certificate. On the server\nside, we should be using that to decide whether to use the DC, and we\nweren\u0027t.\n\nThe new delegated_credentials extension contains another sigalg list.\nThat is used to verify the signature *by* the DC, in the\nCertificateVerify message. (This means DC changes the operative sigalg\nlist for the CertificateVerify message, which is quite a mess.) On the\nserver side, the above CL mixed things up. When deciding whether to use\nDCs, it checked the correct list. When actually using DCs, it checked\nthe wrong one. As a result, any time the DC list wasn\u0027t a subset of the\nmain list, the connection would just break!\n\nFix both of these, in preparation for redoing DCs over the upcoming\nSSL_CREDENTIAL mechanism.\n\nThankfully we don\u0027t support one direction of DC usage (authenticating in\nC++ and verifying in Go), so there are fewer places to worry about\nmixing this up. Given this overcomplication, I\u0027m now much, much less\ninclined to ever support DCs as a client, without an rfc9345bis to redo\nthis.\n\nBug: 249\nChange-Id: Id5257e89a6c8daf1635757be473c45029492d420\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/66550\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "029533f581263c89e92004c064801ef71de0bc3f",
      "old_mode": 33188,
      "old_path": "ssl/extensions.cc",
      "new_id": "e9c38a64999b6041ba49780fa2aba4b130b4783d",
      "new_mode": 33188,
      "new_path": "ssl/extensions.cc"
    },
    {
      "type": "modify",
      "old_id": "2dd78590f9057316b29f0ede27a5e07fba893b1d",
      "old_mode": 33188,
      "old_path": "ssl/internal.h",
      "new_id": "d64f6c482f200d4af764a218d70f4a8da2909622",
      "new_mode": 33188,
      "new_path": "ssl/internal.h"
    },
    {
      "type": "modify",
      "old_id": "17363f328895eda5beaa6a9affb80201ea781009",
      "old_mode": 33188,
      "old_path": "ssl/ssl_cert.cc",
      "new_id": "71baeb77b10a73b4355afb8fcca250c2ae759082",
      "new_mode": 33188,
      "new_path": "ssl/ssl_cert.cc"
    },
    {
      "type": "modify",
      "old_id": "666b4b65b38321a5b9a858951376c9f16f4bf060",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/common.go",
      "new_id": "69d8a695b529a5a4e8879326874610b0fd408d28",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/common.go"
    },
    {
      "type": "modify",
      "old_id": "46194568a5ee42dac44f0e911eb2b47351926409",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/handshake_client.go",
      "new_id": "94e1db3443d11a9e36e9d37711c58e2fce2c0289",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/handshake_client.go"
    },
    {
      "type": "modify",
      "old_id": "26e12579431a9fb829b477e48763b5d6875a44ad",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/handshake_messages.go",
      "new_id": "c3d9dd3b24145c5b59d36f0d50e3f744b23a4e7d",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/handshake_messages.go"
    },
    {
      "type": "modify",
      "old_id": "5e34dbdd8be56a61e30269c80b5de789c3e109f8",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/runner.go",
      "new_id": "4b704db689c0aef916ad1f52165a324cfe0569e6",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/runner.go"
    },
    {
      "type": "modify",
      "old_id": "e0c6a92b1361de26c5878a537027d056cff5af0b",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/sign.go",
      "new_id": "8b381399fdbca4293f93a79eefaba44af5b416f8",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/sign.go"
    }
  ]
}