)]}'
{
  "commit": "f875db367c4da75676744cbaeb48a2d20940e510",
  "tree": "5e87c07b0b8650377be834b00d4d54d9a8520bea",
  "parents": [
    "05ff000a47f874a9856a6ca07af07fda4c056b48"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Thu Sep 18 17:10:44 2025 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Sat Sep 20 16:23:04 2025 -0700"
  },
  "message": "Reject explicit default X.509 versions and empty extension lists\n\nX.509 version fields are declared as DEFAULT v1 which means, in DER, an\nexplicitly encoded version is invalid.\n\nX.509 extension fields are declared as [3] EXPLICIT Extensions OPTIONAL\nand Extensions ::\u003d SEQUENCE SIZE (1..MAX) OF Extension.\n\nThis means in both BER and DER, the extensions list can never be empty.\nInstead, a certificate or CRL with no extensions is supposed to be\nencoded by omitting the OPTIONAL extensions field.\n\nAlso apply the version and extension checks to CRL entries, which we\u0027d\nmissed earlier. All these checks are done by libpki.\n\nUpdate-Note: X509 and X509_CRL parsers are now more spec-compliant and\nreject some invalid inputs. After cl/809456844, internal tests have\npassed with this change. The change was also validated with cl/800872048\nand cl/802241042. Let us know if this encounters problems.\n\nFixed: 42290225, 442221114\nChange-Id: I9a10d76ebb258f297079fc4d77b9eaf63f60b6c4\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/82087\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a452cc6016faa06d86003f1d57d16514478d555d",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "5133d3c188356895f9bfc8d78faeaf1aed293ada",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "0c0874e8891bc4733480b81bb41fc8b6e4528475",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_crl.cc",
      "new_id": "73a579d31f27987c922fefdcce4134c548086839",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_crl.cc"
    },
    {
      "type": "modify",
      "old_id": "26c39fd89947d2199755f0ab2b51e9ba6ef8cd49",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_x509.cc",
      "new_id": "5467777e9a8e280fa554676dd2c41bd54f7f68b4",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_x509.cc"
    }
  ]
}