tree cf7f41dd53ad80824833943a0ca0df77524f0358
parent ab7811ee8751ea699b22095caa70246f641ed3a2
author David Benjamin <davidben@google.com> 1618945110 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1619105312 +0000

Remove some BoringSSL-only X509_CINF functions.

These functions are not in any released version of OpenSSL. The history
is they were added to 1.0.2 beta for CT, but then removed in favor of
i2d_re_X509_tbs. We forked in between the two events.

I'm not sure what the reasoning was upstream's end. I'm thinking:

- X509 currently only captures the serialized TBSCertificate. It might
  be nice to capture the whole Certificate to avoid needing a
  serialization in X509_cmp and make it easier to interop with other
  stacks. (Unclear.) That would require not exporting the X509_CINF
  standalone for serialization.

- The modified bit means, without locking, i2d_X509 is not const or
  thread-safe. We *might* be able to shift the re-encoding to
  i2d_re_X509_tbs, which is already inherently non-const. That requires
  not having X509_CINF_set_modified.

I'm not sure how feasible either of these are, but between that,
upstream alignment, and X509_CINF otherwise being absent from public
accessors, it seems worth removing.

Update-Note: X509_get_cert_info, X509_CINF_set_modified, and
X509_CINF_get_signature are removed. I believe all callers have been
updated. Callers should use i2d_re_X509_tbs, i2d_X509_tbs, and
X509_get0_tbs_sigalg instead.

Change-Id: Ic1906ba383faa7903973cb498402518985dd838c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46985
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>