Google Git Google Git
Sign in
boringssl/boringssl/fc6504a623d8cf5b92fafec714ac28396f67c01b
commit
fc6504a623d8cf5b92fafec714ac28396f67c01b
[log]
author
Lily Chen <chlily@google.com>
Wed Nov 04 19:56:46 2026 +0000
committer
boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Fri Nov 06 09:58:06 2026 -0800
tree
c6744a2c16fd847917109d8c2c6e392016d4eed1
parent
d9e028f8740f434ae561638f1ad524ad21f6b291 [diff] 
pki: Remove support for draft-05 MTCs

After crrev.com/c/8733762, Chrome no longer configures draft-05 MTC CAs,
so this removes MTCAnchor::kPlants04 and the constructor that created
draft-05 anchors, SignatureAlgorithm::kMtcProofDraftPlants04, and the
draft-05 handling in VerifyMTC.

The MTC tests now only use draft-07. The verify_unittest MTC certs are
regenerated with the plants-07 demo tool config, and
TrustStoreCollectionMtcTest is updated for the draft-07 issuer encoding.

Bug: 578145031
Cq-Include-Trybots: chromium/try:linux-rel
Change-Id: I989e65c8d747847bd635a42e617191d06a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/105189
Reviewed-by: Matt Mueller <mattm@google.com>
Auto-Submit: Lily Chen <chlily@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Matt Mueller <mattm@google.com>
36 files changed
tree: c6744a2c16fd847917109d8c2c6e392016d4eed1
  1. .agents/
  2. .bcr/
  3. .github/
  4. _agents/
  5. bench/
  6. cmake/
  7. crypto/
  8. decrepit/
  9. docs/
  10. fuzz/
  11. gen/
  12. include/
  13. infra/
  14. pki/
  15. rust/
  16. ssl/
  17. third_party/
  18. tool/
  19. util/
  20. .bazelignore
  21. .bazelrc
  22. .bazelversion
  23. .clang-format
  24. .clang-format-ignore
  25. .clangd
  26. .gitattributes
  27. .gitignore
  28. API-CONVENTIONS.md
  29. AUTHORS
  30. BREAKING-CHANGES.md
  31. BUILD.bazel
  32. build.json
  33. BUILDING.md
  34. CMakeLists.txt
  35. codereview.settings
  36. CONTRIBUTING.md
  37. FUZZING.md
  38. go.mod
  39. go.sum
  40. INCORPORATING.md
  41. LICENSE
  42. MODULE.bazel
  43. MODULE.bazel.lock
  44. PORTING.md
  45. PRESUBMIT.py
  46. PrivacyInfo.xcprivacy
  47. README.md
  48. SANDBOXING.md
  49. SECURITY.md
  50. STYLE.md
README.md

BoringSSL

BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.

Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.

Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.

BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.

Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.

Project links:

To file a security issue, use the Chromium process and mention in the report this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.

There are other files in this directory which might be helpful: