)]}' { "log": [ { "commit": "f00ee8085f98bcca5991926ea0c6383068ee6d2a", "tree": "4a6e8a8286239132e2954c8cba786b9ad845af6c", "parents": [ "86101b72bbb93913a00a79ac614b138633c1f4a4" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Sep 02 21:17:42 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 08 07:14:47 2026 -0700" }, "message": "pki: Import accumulated test vectors for Merkle Trees\n\nCopies the accumulated tests from the spec, which were already running\non the crypto/x509 implementation, to also test the libpki\nimplementation.\n\nUses a common helper function in the crypto/x509 tests instead of\nduplicating the code.\n\nFixes a bug in the test-only function to generate a subtree consistency\nproof that was missed when allowing empty subtrees in\nboringssl-review.googlesource.com/c/boringssl/+/102227.\n\nBug: 452986180\nChange-Id: I82d58acdd394102a91c104681dea80a56a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102527\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "86101b72bbb93913a00a79ac614b138633c1f4a4", "tree": "7d581f31b0a14459444196c43880c71423ee761e", "parents": [ "4a92579453b35319e2707eab68a0b7d1f8d5d053" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu Jul 30 05:03:49 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Sep 07 03:03:22 2026 -0700" }, "message": "Make all non-asm-included BoringSSL headers at least include \u003copenssl/base.h\u003e.\n\nThis guarantees that any successful header include provides at least the\nbasic macros like `OPENSSL_IS_BORINGSSL`.\n\nChange-Id: If9cbce85eac9aebcf6890524d3f05c7c6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99787\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "4a92579453b35319e2707eab68a0b7d1f8d5d053", "tree": "8fb9f2711cddfc02d46335f43bc3749959a0b6ec", "parents": [ "876bb72c99b4c082d8c3aed6efeacf28baf2f25c" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Jul 17 08:36:13 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 12:32:53 2026 -0700" }, "message": "Start migrating HPKE to use EVP_KEM\n\nThis adds an EVP_KEM based implementation for some of the HPKE KEMs that\nhave EVP equivalents and partially refactors those HPKE KEMs. For now,\nthe EVP_HPKE_KEM struct contains fields supporting both the EVP_KEM\nbased implementation and the legacy implementation in hpke.cc. In the\nfuture they will be further unified to clean up old code paths.\n\nUpdate-Note: EVP_HPKE_KEY_cleanup is no longer a no-op after this\nchange. It is now required to avoid memory leaks.\n\nBug: 535883377\nChange-Id: I90f810a6b256196eaf6cc9b2fd9db7be6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102167\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "876bb72c99b4c082d8c3aed6efeacf28baf2f25c", "tree": "06867610ec58f4d303060de8edb4a9786d998be0", "parents": [ "c35293f00e728d14e3d222de800bc88a612f8f88" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Sep 04 15:39:16 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 10:58:07 2026 -0700" }, "message": "Make EVP_PKEY_dup_ref work for nullptr\n\nIt now returns nullptr rather than crashing.\n\nChange-Id: Iab79f4c10799024a42bd0e25045aa83c6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102507\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "c35293f00e728d14e3d222de800bc88a612f8f88", "tree": "73558eaacf26b11ece69b22e97c6add27ed709bb", "parents": [ "bcc1137ef9500a98501dd26585905212526ec74d" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri Sep 04 05:34:08 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 07:22:55 2026 -0700" }, "message": "Provide `llvm-ranlib` to enable LTO on Linux/Clang.\n\nIt is missing in Chromium\u0027s LLVM build, but in upstream LLVM it\u0027s just a\nsymlink to `llvm-ar` anyway, which then decides to behave like `ar s`.\n\nThis should fix the `linux_clang_lto` build.\n\nBug: 491518614\nChange-Id: I8b174e2780c2cb4232d404270c27f2746a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102449\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "bcc1137ef9500a98501dd26585905212526ec74d", "tree": "55ad6ce76b757c248e491f5895bb2f32e27bb9ce", "parents": [ "c5c273f34640aeacdd73ce502e5072202777ceb5" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri Sep 04 05:47:39 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 06:47:58 2026 -0700" }, "message": "`linux_clang_lto`: use the `lld` linker.\n\nNot only is it recommended for ThinLTO anyway on\nhttps://clang.llvm.org/docs/ThinLTO.html - we don\u0027t even have the\nsupport files to use the default `gold` in Chromium\u0027s LLVM:\n\n```\n/usr/bin/ld: /b/s/w/ir/cache/builder/boringssl/util/bot/llvm-build/bin/../lib/LLVMgold.so: error loading plugin: /b/s/w/ir/cache/builder/boringssl/util/bot/llvm-build/bin/../lib/LLVMgold.so: cannot open shared object file: No such file or directory\n```\n\nBug: 491518614\nChange-Id: Ie091ebe64811c4be5b89ccdf99d688a96a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102468\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "c5c273f34640aeacdd73ce502e5072202777ceb5", "tree": "d16985885553c3ba626d5aae58a935051ec1eaf2", "parents": [ "4ae8cf504e4b27e6fd27f4aea9fe15c886c3f78f" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri Sep 04 05:51:09 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 06:32:51 2026 -0700" }, "message": "Partial rollback of I79853ef115ee6c86bc58acc9adedf4c16a6a6964.\n\nThe changes to `ecdsa_test.cc` are flaky, as apparently which error code\nis received itself is flaky. To be figured out later.\n\nFixes:\n\n```\nC:\\b\\s\\w\\ir\\cache\\builder\\boringssl\\crypto\\fipsmodule\\ecdsa\\ecdsa_test.cc(103): error: Value of: ErrorsAreAndClear({{ERR_LIB_ECDSA, 100}})\n Actual: false (Got \"error:0f000085:elliptic curve routines:OPENSSL_internal:INVALID_SCALAR\", wanted \"error:1a000064:ECDSA routines:OPENSSL_internal:BAD_SIGNATURE\")\nExpected: true\nGoogle Test trace:\nC:\\b\\s\\w\\ir\\cache\\builder\\boringssl\\crypto\\fipsmodule\\ecdsa\\ecdsa_test.cc(118): 1\nC:\\b\\s\\w\\ir\\cache\\builder\\boringssl\\crypto\\fipsmodule\\ecdsa\\ecdsa_test.cc(171): secp224k1\n```\n\nBug: 42290241\nChange-Id: I511cc480315f84e70944d4bfdd322fb36a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102487\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "4ae8cf504e4b27e6fd27f4aea9fe15c886c3f78f", "tree": "3b3523b9827133d6b528485357f469efc4e1942a", "parents": [ "1175b7e1fa2144bab5f359ebf387548f7e4b5cdf" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue Jul 21 07:23:10 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 04:51:01 2026 -0700" }, "message": "Fix a bunch more tests that get an error but don\u0027t clear the error queue.\n\nBug: 42290241\nChange-Id: I79853ef115ee6c86bc58acc9adedf4c16a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99148\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "1175b7e1fa2144bab5f359ebf387548f7e4b5cdf", "tree": "c0f39bebb810c9523aca07cfd4aeb94570bb8c04", "parents": [ "3976bc8638f4d2740adb48136a402ca5b090cd99" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri Sep 04 01:21:31 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 02:02:14 2026 -0700" }, "message": "Enable Clang LTO builder (on mac_aarch64) on CI and CQ.\n\nTested: it passed on CQ on this CL.\n\nBug: 491518614\nChange-Id: Id33d1dbe0606c662ad5c072904bad9406a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102407\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "3976bc8638f4d2740adb48136a402ca5b090cd99", "tree": "6fcc999811bef4109fd3bdca6398998133b5dd6f", "parents": [ "9bb13b04a9946c6f54ae6b94fbac1fb4d4c33b8e" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu Sep 03 04:32:15 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 01:42:59 2026 -0700" }, "message": "Enable GCC LTO builder on CI and CQ.\n\nTested: it passed on CQ on this CL.\n\n(Clang LTO not working yet, so not enabling that one for now)\n\nBug: 491518614\nChange-Id: I73342e2417b9b9aca2780ab6f84ac0e26a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102307\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "9bb13b04a9946c6f54ae6b94fbac1fb4d4c33b8e", "tree": "70ce86fa7441fe97e977c3f8b9c2be8a851af00b", "parents": [ "bd9240667bfe7ac98dc0ce108ca7898fdc82c71a" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri Sep 04 00:18:44 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 04 00:39:03 2026 -0700" }, "message": "Add a `mac_arm64_lto` builder too.\n\nOriginally I wanted a `linux_clang_lto` to cover Clang\u0027s ThinLTO, but\nour LLVM build lacks `ranlib` right now.\n\nBug: 491518614\nChange-Id: I5a2ba522aa36d5961adbc661228dd6066a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102387\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "bd9240667bfe7ac98dc0ce108ca7898fdc82c71a", "tree": "cdab381c790aba65305fa4db1766fe6ef65f8ac5", "parents": [ "4cabe8ce9f98b689ce4bf2caec985e9d6bb7899d" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Sep 02 16:20:39 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 17:16:37 2026 -0700" }, "message": "pki: Allow Merkle subtrees of size 0\n\ndraft-ietf-plants-merkle-tree-certs-05 now allows subtrees with size 0\nto be considered valid. This required tweaking the API for consistency\nproofs.\n\nThe previously exposed \"evaluate subtree consistency proof\" function is\nunexported, because this operation is not well defined for an empty\nsubtree, and that functionality is instead exposed as \"verify subtree\nconsistency proof\", which now matches section 4.4.3 of the draft.\n\nBug: 452986180\nChange-Id: I735bdcaba357816d6102d258b72662666a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102227\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "4cabe8ce9f98b689ce4bf2caec985e9d6bb7899d", "tree": "7ba6df37b7a5ad4f9219ea337a3706e873f1c6f0", "parents": [ "5d6989e1e2bfbc592876a5d88c4d1d7591a462ec" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Tue Sep 01 16:40:50 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 17:11:12 2026 -0700" }, "message": "EVP_KEM: Expose external entropy encap methods for testing only\n\nChange-Id: I4f521dbd53063d1965e06a80fd2c195e6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102147\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "5d6989e1e2bfbc592876a5d88c4d1d7591a462ec", "tree": "eb5f10a0fa99dabbe6bd7a768771e911b4587667", "parents": [ "0ce57bbf06a35864fa39e3b9346d41e833683383" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Thu Sep 03 19:12:31 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 13:21:37 2026 -0700" }, "message": "Fix some clang-tidy findings\n\nChange-Id: I4306d8c7451c6e168e1a7375e44dddb26a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102367\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "0ce57bbf06a35864fa39e3b9346d41e833683383", "tree": "96e4b713131c217e51873e4ee80430f48617b9cb", "parents": [ "278e88355cdd73b0fefd4040ece4490a784e4a8b" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Thu Sep 03 06:27:52 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 06:44:40 2026 -0700" }, "message": "Update version for Bazel Central Repository to 0.20260903.0\n\nChange-Id: Ifa14b05316ec91cb5d4e70d87ad78a3dd65a5489\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102327\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "278e88355cdd73b0fefd4040ece4490a784e4a8b", "tree": "a7b37c3a4f2237c1ee9a0f07c8ab1ca33e081b01", "parents": [ "4ebe638cbfa7c4d317ddd4808f92b487714bde64" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu Sep 03 03:22:42 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 03:46:06 2026 -0700" }, "message": "Add includable-only builders for LTO.\n\nOnly enabling on Linux-gcc and Linux-clang for now.\n\nBug: 491518614\nChange-Id: I6e4d4dee87595aa1ff78ff14737eda516a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102287\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "4ebe638cbfa7c4d317ddd4808f92b487714bde64", "tree": "798ad8160b3c21415156418a1cb989c8e5c8d992", "parents": [ "88dcf4b57c9bfcbd8648b8d83561c4b661818338" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Sep 02 19:38:05 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 23:23:11 2026 -0700" }, "message": "Test that SSL_write(0) does not write a record\n\nIt behaves just fine, but I thought it didn\u0027t and we have no test that\nasserts this. Add a test.\n\nChange-Id: I0e061870a6a4ac56191559ed0e324e9b92a5f9d2\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102267\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "88dcf4b57c9bfcbd8648b8d83561c4b661818338", "tree": "60b15030eac6b58c4cfbcce54e1230cf4a8e4eaa", "parents": [ "be70b802a54249d9cc6899e7c93455933bf64303" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Sep 02 19:11:55 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 23:23:03 2026 -0700" }, "message": "Clarify the return values from SSL operations\n\n- Discuss the silly edge cases when you ask to read or write zero bytes.\n\n- Outside the silly cases, SSL_write will never return 0 (even if we\u0027re\n blocked on EOF). Document this.\n\n- SSL_read and SSL_do_handshake can return zero if they consume a TLS-\n or transport-level EOF. Document that\u0027s what this means.\n SSL_do_handshake probably should not have this case, but for now just\n leave a TODO.\n\nChange-Id: Iebf4fff6d4048bdc01db668a56695e3f12189fae\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102248\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "be70b802a54249d9cc6899e7c93455933bf64303", "tree": "90ddbcc9e9e05b2cd95c5e85a02833647b546b21", "parents": [ "850a037a1a600d9a4e8661ee3c1f8d65c4d071c3" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Sep 02 18:42:09 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 23:07:49 2026 -0700" }, "message": "Fix up some BIO documentation\n\nFor better or worse, BIO_flush sometimes returns -1 on error right now\n(the base64 BIO for a start). Maybe we can change that. Also mention the\nconnection between BIO operations and BIO_should_*.\n\nChange-Id: I3fae1bf2e160e5839c8ca7dd61aa17ea5b1153e8\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102247\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "850a037a1a600d9a4e8661ee3c1f8d65c4d071c3", "tree": "e1a0d129fd6ca805a95fd1bd8c58c593fd7d95e5", "parents": [ "c66572ad4dcdbd388a2802378a7e422a7f7d82e1" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue Sep 01 09:34:47 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 22:26:50 2026 -0700" }, "message": "ML-DSA: Add branchless pre-paths to `scalar_from_keccak_block_vartime`.\n\nStep sizes were tuned to be two steps below the performance cliff on the\ntwo machines I could test on - as such, it might be possible to go one\npower of two up with both, but I have not tested x86-32 with gcc yet.\n\nThis mirrors I29afe4aa283b686b9fc3877e059931f46a6a6964.\n\nBenchmark results show visible improvements on aarch64, and minor\nimprovements (and some noise) on x86-64.\n\naarch64 Apple M1 Pro:\n\nDid 478406 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (34062.0 ops/sec) [+2.3%]\nDid 113081 BM_SpeedMLDSASign/ml_dsa_44/threads:1 operations (8081.8 ops/sec) [+0.7%]\nDid 548225 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 operations (38954.3 ops/sec) [+3.5%]\nDid 550051 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 operations (39301.2 ops/sec) [+4.3%]\nDid 292483 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (20914.8 ops/sec) [+4.2%]\nDid 72096 BM_SpeedMLDSASign/ml_dsa_65/threads:1 operations (5259.3 ops/sec) [+2.6%]\nDid 353481 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 operations (25263.4 ops/sec) [+4.0%]\nDid 353876 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 operations (25129.6 ops/sec) [+3.0%]\nDid 188579 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (13391.8 ops/sec) [+4.3%]\nDid 63078 BM_SpeedMLDSASign/ml_dsa_87/threads:1 operations (4445.1 ops/sec) [+1.9%]\nDid 212113 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 operations (15163.5 ops/sec) [+3.2%]\nDid 212799 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 operations (15245.3 ops/sec) [+4.2%]\n\nx86-64 AMD EPYC 7B13:\n\nDid 282226 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (20139.5 ops/sec) [+1.0%]\nDid 72860 BM_SpeedMLDSASign/ml_dsa_44/threads:1 operations (5151.6 ops/sec) [+0.5%]\nDid 338622 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 operations (24190.9 ops/sec) [-0.1%]\nDid 338496 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 operations (24209.9 ops/sec) [-0.3%]\nDid 169634 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (12109.9 ops/sec) [+0.6%]\nDid 47056 BM_SpeedMLDSASign/ml_dsa_65/threads:1 operations (3360.3 ops/sec) [+0.0%]\nDid 213332 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 operations (15228.8 ops/sec) [+0.6%]\nDid 213440 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 operations (15239.7 ops/sec) [+0.7%]\nDid 112765 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (8066.8 ops/sec) [+1.6%]\nDid 40735 BM_SpeedMLDSASign/ml_dsa_87/threads:1 operations (2908.1 ops/sec) [-0.2%]\nDid 132878 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 operations (9494.2 ops/sec) [+0.3%]\nDid 133291 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 operations (9490.9 ops/sec) [+0.6%]\n\nBug: 503700354\nChange-Id: If01af7f92b2050176c96b77844505f216a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102108\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "c66572ad4dcdbd388a2802378a7e422a7f7d82e1", "tree": "a3021afa1d569c80d1af44ca678566d04813c8df", "parents": [ "36d3eb4b1ff8a8f33bf4f4999497cb0737c67b5a" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed Sep 02 01:06:43 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 08:12:22 2026 -0700" }, "message": "ML-DSA: Use fewer branches in `scalar_uniform_block`.\n\nI also tried adding a branchless pre-path, but it did not help\nperformance - these changes done as part of it however did for\nML-DSA-65, so sending just those.\n\nThis affects only KeyGen, and disproportionally helps ML-DSA-65.\n\naarch64 Apple M1 Pro:\n\nDid 468233 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (33286.2 ops/sec) [+1.8%]\nDid 280959 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (20077.3 ops/sec) [+24.4%]\nDid 179884 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (12844.4 ops/sec) [+1.5%]\n\nx86-64 AMD EPYC 7B13:\n\nDid 280067 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (19946.8 ops/sec) [+0.6%]\nDid 168944 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (12041.8 ops/sec) [+16.4%]\nDid 112193 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (7938.9 ops/sec) [-0.1%]\n\nBug: 503700354\nChange-Id: Iffdb5e0fb3c9ceba3912e33f498a1ee96a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102207\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "36d3eb4b1ff8a8f33bf4f4999497cb0737c67b5a", "tree": "98e370633f15d432f0850b6914ab37a497fdd719", "parents": [ "e1fa1509f678e75474da933db11b13981d5fbddf" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 28 15:57:04 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 18:59:19 2026 -0700" }, "message": "Use Unicode characters for math in code comments\n\nReplaces a selection of single-chracter superscripts and subscripts, and\nother math symbols in code comments with Unicode equivalents, for better\nreadability. Because of rendering inconsistencies between platforms,\nmultiple-character superscript and subscript terms have not been\nconverted to Unicode characters.\n\nChange-Id: I513ec5cb1d87509e11c6a6b979be88016a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102047\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "e1fa1509f678e75474da933db11b13981d5fbddf", "tree": "6aa8ea8d67974ab1fe87b0af189bb3c654d86111", "parents": [ "01a3425cbf20d2c8b235aad93b4bbed508e27d33" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Mon Aug 31 20:14:56 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 18:59:02 2026 -0700" }, "message": "Import tests for large Merkle Tree inclusion and consistency proofs\n\nImports test vectors from\ngithub.com/ietf-plants-wg/merkle-tree-certs/pull/301 to test both\nimplementations of Merkle Trees.\n\nBug: 503746594, 452986180\nChange-Id: I464c3c9e15ea9defff03a04e6ef5e39f6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102087\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "01a3425cbf20d2c8b235aad93b4bbed508e27d33", "tree": "48c851c0d215f1834826439c808077a2ed3a7646", "parents": [ "79b7305a55b8ddff3c3ff95533a7aaff56ccb48d" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon Aug 17 11:22:33 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 13:59:50 2026 -0700" }, "message": "curve25519: Elligator 2 map_to_curve implementation\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I3cdcb0f6a8f6a2fe754013cee515f0466a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101148\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "79b7305a55b8ddff3c3ff95533a7aaff56ccb48d", "tree": "9320f36637642dccb29257f33b8f5d339bd70b5c", "parents": [ "e9b9cf00420f894cccb629af0ad9c9d410583fab" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue Sep 01 08:35:08 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 09:38:27 2026 -0700" }, "message": "ML-DSA: add Keccak x4 support.\n\nThis is basically a port of 8daf854545e60454740b3c2286de391bcf8b1685\nfrom ML-KEM.\n\nOnly small improvements on aarch64, but massive improvements on x86-64.\n\naarch64 Apple M1 Pro:\n\nDid 23153 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (33067.7 ops/sec) [+2.5%]\nDid 5817 BM_SpeedMLDSASign/ml_dsa_44/threads:1 operations (8109.4 ops/sec) [-0.2%]\nDid 253549 BM_SpeedMLDSAParsePubKey/ml_dsa_44/threads:1 operations (357425.4 ops/sec) [-1.1%]\nDid 26062 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 operations (38089.8 ops/sec) [+0.8%]\nDid 26751 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 operations (38209.4 ops/sec) [+1.1%]\nDid 11327 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (16189.1 ops/sec) [+0.9%]\nDid 3650 BM_SpeedMLDSASign/ml_dsa_65/threads:1 operations (5250.0 ops/sec) [+1.8%]\nDid 185026 BM_SpeedMLDSAParsePubKey/ml_dsa_65/threads:1 operations (264028.7 ops/sec) [-0.5%]\nDid 17160 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 operations (24510.6 ops/sec) [+4.2%]\nDid 17186 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 operations (24555.3 ops/sec) [+1.7%]\nDid 8932 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (12802.3 ops/sec) [+1.7%]\nDid 3165 BM_SpeedMLDSASign/ml_dsa_87/threads:1 operations (4381.6 ops/sec) [-0.1%]\nDid 145645 BM_SpeedMLDSAParsePubKey/ml_dsa_87/threads:1 operations (208208.8 ops/sec) [+1.1%]\nDid 10307 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 operations (14741.2 ops/sec) [+1.7%]\nDid 10302 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 operations (14715.9 ops/sec) [+3.9%]\n\nx86-64 AMD EPYC 7B13:\n\nDid 13796 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (19726.2 ops/sec) [+19.3%]\nDid 3675 BM_SpeedMLDSASign/ml_dsa_44/threads:1 operations (5120.6 ops/sec) [+1.4%]\nDid 155308 BM_SpeedMLDSAParsePubKey/ml_dsa_44/threads:1 operations (221784.4 ops/sec) [+1.1%]\nDid 16906 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 operations (24154.9 ops/sec) [+21.3%]\nDid 16865 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 operations (24128.6 ops/sec) [+21.4%]\nDid 7246 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (10344.9 ops/sec) [+17.9%]\nDid 2369 BM_SpeedMLDSASign/ml_dsa_65/threads:1 operations (3461.7 ops/sec) [+11.5%]\nDid 103849 BM_SpeedMLDSAParsePubKey/ml_dsa_65/threads:1 operations (148677.9 ops/sec) [+0.2%]\nDid 10579 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 operations (15057.3 ops/sec) [+22.9%]\nDid 10711 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 operations (15178.8 ops/sec) [+23.9%]\nDid 5502 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (7879.5 ops/sec) [+24.9%]\nDid 2044 BM_SpeedMLDSASign/ml_dsa_87/threads:1 operations (3009.9 ops/sec) [+13.4%]\nDid 77857 BM_SpeedMLDSAParsePubKey/ml_dsa_87/threads:1 operations (111054.2 ops/sec) [+0.7%]\nDid 6569 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 operations (9391.4 ops/sec) [+28.1%]\nDid 6445 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 operations (9275.8 ops/sec) [+26.7%]\n\nBug: 503700354\nChange-Id: I09c1ef686314a05586ecefe1382239556a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102127\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "e9b9cf00420f894cccb629af0ad9c9d410583fab", "tree": "d0ceff21f11dbd568d87514d4389ae1236cc60e4", "parents": [ "f341ba401f765c8e4b5194e785352d8eea92ba20" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 31 04:27:27 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 23:35:32 2026 -0700" }, "message": "ML-KEM: Add a branchless pre-path to `scalar_from_keccak_block_vartime`.\n\nThis mirrors https://go.dev/cl/818725.\n\nOn aarch64 Apple M1 Pro:\n\nDid 33376 BM_SpeedMLKEM768KeyGenDecap/threads:1 operations (47765.6 ops/sec) [+19.4%]\nDid 53730 BM_SpeedMLKEM768ParseEncap/threads:1 operations (76357.6 ops/sec) [+9.5%]\nDid 24107 BM_SpeedMLKEM1024KeyGenDecap/threads:1 operations (34840.2 ops/sec) [+23.7%]\nDid 39086 BM_SpeedMLKEM1024ParseEncap/threads:1 operations (55732.7 ops/sec) [+16.0%]\n\nOn x86-64 AMD EPYC 7B13:\n\nDid 13426 BM_SpeedMLKEM768KeyGenDecap/threads:1 operations (19159.0 ops/sec) [+7.9%]\nDid 22704 BM_SpeedMLKEM768ParseEncap/threads:1 operations (32587.3 ops/sec) [+3.4%]\nDid 9885 BM_SpeedMLKEM1024KeyGenDecap/threads:1 operations (14088.9 ops/sec) [+11.0%]\nDid 16832 BM_SpeedMLKEM1024ParseEncap/threads:1 operations (24070.4 ops/sec) [+6.2%]\n\nAlso tried 1x (about 2% worse), 4x (about 1% better), 8x (much worse),\nwhere the factor refers to iterations of the branchful loop (each\nwriting zero to two output words from 3 input bytes). Staying away from\n4x for now as running out of registers has awful performance\nconsequences, but leaving the option open if a confirmed speedup on all\nrelevant platforms.\n\nBug: 503700354\nChange-Id: I29afe4aa283b686b9fc3877e059931f46a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101987\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "f341ba401f765c8e4b5194e785352d8eea92ba20", "tree": "e0e49497f85a07965aa593cd78b741407d7a2206", "parents": [ "784fcafc464b219638e1e7dcad923d7476093ab0" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon Aug 31 14:51:11 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 13:53:36 2026 -0700" }, "message": "Update to Go 1.27.0\n\nUpdate-Note: Dependency on the pre-Go-1.27 filippo.io/mldsa package is\nnow removed in favor of the standard library version.\n\nFixed: 505771670\nChange-Id: I522843136ebc5fce87409e66371b80a5ef7c3fd5\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102027\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "784fcafc464b219638e1e7dcad923d7476093ab0", "tree": "ee5fd828afe55eb06cac7ce50075398e337b9dbf", "parents": [ "0fd9b5f3e425b0c9fa11a3ee3f860c8055f79d73" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Mon Aug 31 20:05:30 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 13:30:19 2026 -0700" }, "message": "runner: Replace redundant flagCurves and flagCertTypes functions\n\nThese can be replaced by flagInts with an appropriate type interface.\n\nChange-Id: I7c23db8bcdc52d8eceaf2c85a99494096a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102067\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "0fd9b5f3e425b0c9fa11a3ee3f860c8055f79d73", "tree": "f544a2cb77ca10eb74eab51c1aab04ee92caffac", "parents": [ "8791438c5d5956f7bf4df5236dc16dc5831de738" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Aug 12 20:45:14 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 13:30:09 2026 -0700" }, "message": "Add APIs for configuring TLS 1.3 ciphers with equipreference groups\n\nAdds new APIs for configuring TLS 1.3 cipher preference list, either\nwith or without \"equipreference group\" flags.\n\nFixed: 545123692\nChange-Id: Id9e04b8f4314cd42f90ec816dd844de06a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101827\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "8791438c5d5956f7bf4df5236dc16dc5831de738", "tree": "130ea48f099137af7ef645f8d7def01a4ad473bb", "parents": [ "ac39ea6853833c1f18fd23614091d11855e71752" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon Aug 31 14:42:03 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 11:59:40 2026 -0700" }, "message": "Remove stray temporary file\n\nThis was checked in as part of\nhttps://boringssl-review.googlesource.com/c/boringssl/+/101547 but\nshouldn\u0027t have been.\n\nChange-Id: If3e37ba6e50da5a5623004b5e103698056addf16\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102007\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "ac39ea6853833c1f18fd23614091d11855e71752", "tree": "117351ac1c474c38333cfac64b8e5b525f249941", "parents": [ "281fb6d844f8ef70c95ce9d3d599652cc2448292" ], "author": { "name": "Matt Mueller", "email": "mattm@google.com", "time": "Fri Aug 28 10:42:42 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 11:43:24 2026 -0700" }, "message": "[MTCs] remove deprecated MTCAnchor constructor\n\nBug: 452986180\nChange-Id: I3b72973fecc2d7feafda12e5c7f08cc6dc8e189c\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101927\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Matt Mueller \u003cmattm@google.com\u003e\nCommit-Queue: Matt Mueller \u003cmattm@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "281fb6d844f8ef70c95ce9d3d599652cc2448292", "tree": "d658893db157bc8ee23cdbc6fbb47b4a9fe0c2c5", "parents": [ "cf44c6429335d03ebe546bd86ecc1d8f805bede5" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 21 18:45:45 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 10:02:02 2026 -0700" }, "message": "Use SSLCipherPreferenceList for TLS 1.3 ciphers\n\nThis change is a refactor to use a SSLCipherPreferenceList to hold the\nTLS 1.3 cipher preference list in SSL_CTX and SSL_CONFIG. In\nSSL_CTX_new, it is populated with one of two default lists depending on\nwhether we have EVP hardware. The default lists are ordered lists with\nequipreference groups layered on top (for servers). SSL_new copies the\nlist from the SSL_CTX.\n\nThis CL also rewrites the logic for TLS 1.3 cipher suite selection for\nSSL compliance policies to express it in terms of\nSSLCipherPreferenceList.\n\nThis paves the way for a future CL which will add a general purpose API\nto configure the list.\n\nBug: 545123692\nChange-Id: Id57d698c288f603225706cd53b00cc696a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101167\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "cf44c6429335d03ebe546bd86ecc1d8f805bede5", "tree": "9995b5dc23aff1d3ecba4b1b95341dbe1b4e0b8d", "parents": [ "3c7d22421d28c924f98c4f6f9911065a65adc7a8" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 31 01:58:03 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 09:37:24 2026 -0700" }, "message": "Leave intermediates partially reduced in ML-KEM NTT\n\nThis ports a074f282d026a0ebbed7c9efef5a0cf63f72338d\u0027s change to ML-DSA.\n\nChanges relative to the ML-DSA changes:\n\n- Barrett reduction needed to be adjusted from 24 to 32 bits so it can\n successfully reduce any uint32_t to 0..2*kPrime range.\n- NTT using partial reduction uses intermediates of up to 15*kPrime,\n which fits in uint16_t.\n- INTT using partial reduction uses intermediates of up to 128*kPrime,\n which required storing intermediates in an uint32_t array. This wasn\u0027t\n a problem in ML-DSA as it already stores vectors of uint32_t to begin\n with.\n\nSaves about 4.9% to 8.1% for TLS ML-KEM operations (most savings being\nin Encap and Decap, namely 11.0% to 14.7%) on aarch64 Apple M1 Pro:\n\nDid 27910 BM_SpeedMLKEM768KeyGenDecap/threads:1 operations (39989.3 ops/sec) [+4.9%]\nDid 48780 BM_SpeedMLKEM768ParseEncap/threads:1 operations (69751.4 ops/sec) [+7.6%]\nDid 19862 BM_SpeedMLKEM1024KeyGenDecap/threads:1 operations (28153.9 ops/sec) [+5.1%]\nDid 33890 BM_SpeedMLKEM1024ParseEncap/threads:1 operations (48063.6 ops/sec) [+8.1%]\nDid 46596 BM_SpeedMLKEM768KeyGenOnly/threads:1 operations (66675.0 ops/sec) [+2.9%]\nDid 45743 BM_SpeedMLKEM768PrivateKeyFromSeedOnly/threads:1 operations (65436.1 ops/sec) [+1.9%]\nDid 68136 BM_SpeedMLKEM768DecapOnly/threads:1 operations (96674.0 ops/sec) [+11.0%]\nDid 85036 BM_SpeedMLKEM768ParseOnly/threads:1 operations (120954.2 ops/sec) [+2.7%]\nDid 105067 BM_SpeedMLKEM768EncapOnly/threads:1 operations (150126.4 ops/sec) [+14.4%]\nDid 30992 BM_SpeedMLKEM1024KeyGenOnly/threads:1 operations (44467.0 ops/sec) [+3.2%]\nDid 30577 BM_SpeedMLKEM1024PrivateKeyFromSeedOnly/threads:1 operations (43805.5 ops/sec) [+2.9%]\nDid 50684 BM_SpeedMLKEM1024DecapOnly/threads:1 operations (73954.1 ops/sec) [+14.7%]\nDid 54923 BM_SpeedMLKEM1024ParseOnly/threads:1 operations (77869.7 ops/sec) [+2.6%]\nDid 82865 BM_SpeedMLKEM1024EncapOnly/threads:1 operations (118470.5 ops/sec) [+14.1%]\n\nMinor improvements (2.9% to 4.5% but only for parse/encap) on AMD EPYC 7B13:\n\nDid 12436 BM_SpeedMLKEM768KeyGenDecap/threads:1 operations (17751.4 ops/sec) [+0.0%]\nDid 22079 BM_SpeedMLKEM768ParseEncap/threads:1 operations (31509.8 ops/sec) [+2.9%]\nDid 8851 BM_SpeedMLKEM1024KeyGenDecap/threads:1 operations (12692.4 ops/sec) [-0.2%]\nDid 15821 BM_SpeedMLKEM1024ParseEncap/threads:1 operations (22667.0 ops/sec) [+4.5%]\nDid 23994 BM_SpeedMLKEM768KeyGenOnly/threads:1 operations (34374.9 ops/sec) [-1.9%]\nDid 23451 BM_SpeedMLKEM768PrivateKeyFromSeedOnly/threads:1 operations (33470.7 ops/sec) [-1.7%]\nDid 24538 BM_SpeedMLKEM768DecapOnly/threads:1 operations (35050.9 ops/sec) [+1.9%]\nDid 50112 BM_SpeedMLKEM768ParseOnly/threads:1 operations (71421.1 ops/sec) [+1.1%]\nDid 36402 BM_SpeedMLKEM768EncapOnly/threads:1 operations (52087.7 ops/sec) [+4.9%]\nDid 16656 BM_SpeedMLKEM1024KeyGenOnly/threads:1 operations (23778.1 ops/sec) [-0.7%]\nDid 16274 BM_SpeedMLKEM1024PrivateKeyFromSeedOnly/threads:1 operations (23304.1 ops/sec) [-0.5%]\nDid 18824 BM_SpeedMLKEM1024DecapOnly/threads:1 operations (26908.8 ops/sec) [+3.0%]\nDid 33258 BM_SpeedMLKEM1024ParseOnly/threads:1 operations (47471.2 ops/sec) [+1.0%]\nDid 28276 BM_SpeedMLKEM1024EncapOnly/threads:1 operations (40380.6 ops/sec) [+7.4%]\n\nBug: 503700354\nChange-Id: Idd4b6e8986253288e09e40b8ffbf3adf6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101967\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "3c7d22421d28c924f98c4f6f9911065a65adc7a8", "tree": "fed256a950292892d979969e9d153e33b0a2920b", "parents": [ "a074f282d026a0ebbed7c9efef5a0cf63f72338d" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Sun Aug 30 21:09:58 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 31 06:15:44 2026 -0700" }, "message": "rust: bssl-tls: Gate all Apple platforms\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: If0f64e466be268ffc52d1f25055a26d76a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101947\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "a074f282d026a0ebbed7c9efef5a0cf63f72338d", "tree": "97a5d989fff03602baea603068ead45ea49ce4b2", "parents": [ "da02aac3ebb96152074ea180a5a74559b82343b1" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Aug 26 15:31:06 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Sun Aug 30 11:13:56 2026 -0700" }, "message": "Leave intermediates partially reduced in ML-DSA NTT\n\nCredit to Filippo Valsorda for doing something similar in\nhttps://go-review.googlesource.com/c/go/+/822040/\n\nThis is quite effective on aarch64 (Apple M1 Pro):\n\nBenchmark Time CPU Time Old Time New CPU Old CPU New\n--------------------------------------------------------------------------------------------------------------------------------------------------\nBM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 -0.1039 -0.1039 33944 30417 33944 30416\nBM_SpeedMLDSASign/ml_dsa_44/threads:1 -0.1277 -0.1280 140310 122385 140308 122343\nBM_SpeedMLDSAParsePubKey/ml_dsa_44/threads:1 +0.0080 +0.0049 2417 2436 2417 2429\nBM_SpeedMLDSAVerify/ml_dsa_44/threads:1 -0.0991 -0.0990 29312 26406 29308 26406\nBM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 -0.0993 -0.0993 29266 26360 29266 26360\nBM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 -0.0786 -0.0784 67418 62122 67405 62121\nBM_SpeedMLDSASign/ml_dsa_65/threads:1 -0.1127 -0.1127 221116 196194 221066 196151\nBM_SpeedMLDSAParsePubKey/ml_dsa_65/threads:1 +0.0040 +0.0034 3581 3595 3580 3593\nBM_SpeedMLDSAVerify/ml_dsa_65/threads:1 -0.0940 -0.0937 45508 41230 45492 41229\nBM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 -0.0920 -0.0913 45578 41383 45535 41378\nBM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 -0.0817 -0.0818 86174 79132 86174 79126\nBM_SpeedMLDSASign/ml_dsa_87/threads:1 -0.1084 -0.1084 251821 224521 251813 224520\nBM_SpeedMLDSAParsePubKey/ml_dsa_87/threads:1 +0.0004 -0.0004 4793 4795 4786 4785\nBM_SpeedMLDSAVerify/ml_dsa_87/threads:1 -0.0695 -0.0696 74345 69180 74344 69170\nBM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 -0.0717 -0.0717 74405 69072 74405 69071\n\nLess visible on x86_64 (AMD Ryzen Threadripper PRO 7945WX 12-Cores)\n\nBenchmark Time CPU Time Old Time New CPU Old CPU New\n--------------------------------------------------------------------------------------------------------------------------------------------------\nBM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 -0.0184 -0.0184 38295 37591 38293 37589\nBM_SpeedMLDSASign/ml_dsa_44/threads:1 -0.0041 -0.0041 124470 123958 124458 123949\nBM_SpeedMLDSAParsePubKey/ml_dsa_44/threads:1 -0.0043 -0.0043 2740 2728 2740 2728\nBM_SpeedMLDSAVerify/ml_dsa_44/threads:1 -0.0216 -0.0216 31537 30855 31534 30854\nBM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 -0.0272 -0.0271 31575 30718 31572 30716\nBM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 -0.0191 -0.0191 72158 70780 72153 70775\nBM_SpeedMLDSASign/ml_dsa_65/threads:1 -0.0304 -0.0305 198536 192510 198519 192470\nBM_SpeedMLDSAParsePubKey/ml_dsa_65/threads:1 -0.0004 -0.0003 4084 4083 4084 4082\nBM_SpeedMLDSAVerify/ml_dsa_65/threads:1 -0.0168 -0.0168 49948 49111 49944 49107\nBM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 -0.0197 -0.0197 50288 49299 50286 49297\nBM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 -0.0161 -0.0161 101991 100347 101979 100335\nBM_SpeedMLDSASign/ml_dsa_87/threads:1 -0.0132 -0.0132 240216 237045 240183 237024\nBM_SpeedMLDSAParsePubKey/ml_dsa_87/threads:1 -0.0052 -0.0051 5468 5439 5467 5439\nBM_SpeedMLDSAVerify/ml_dsa_87/threads:1 -0.0275 -0.0276 84974 82635 84969 82625\nBM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 -0.0258 -0.0257 84841 82652 84829 82649\n\nBug: 503700354\nChange-Id: I14b83d24c3585a42959241907bab2005d1e4f5aa\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101807\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "da02aac3ebb96152074ea180a5a74559b82343b1", "tree": "f93a76dbd0b8bb48f80c2da55c1b2a173314169e", "parents": [ "533902fb2e8fd0586db7d58879d697721726605a" ], "author": { "name": "Matt Mueller", "email": "mattm@google.com", "time": "Wed Aug 26 15:40:49 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 28 10:33:36 2026 -0700" }, "message": "[MTCs] change MTCAnchor trusted_subtrees_ to a vector instead of map\n\nBug: 452986180\nChange-Id: I41c19c3ab66edaf868355ab93713f10c8bd6782c\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101847\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Matt Mueller \u003cmattm@google.com\u003e\n" }, { "commit": "533902fb2e8fd0586db7d58879d697721726605a", "tree": "fb6820baff5ac5ff0017d85ae425a9e1c6845e47", "parents": [ "b110de1e4b29426ec4579a5529b15df972b5ce4c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Aug 27 04:15:35 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 27 14:20:29 2026 -0700" }, "message": "Give SSL_CREDENTIAL an optional session ID context\n\nIf unset, it falls back to the SSL_CTX one, mostly for compatibility\nwith the existing behavior. We might reconsider this, especially if we\ndecide resumptionr should require a sid_ctx to opt in anyway\n(crbug.com/553551564).\n\nFixed: 524717546\nChange-Id: I5d105a56983f9bbb5b2bd68e8489b376cefd91f9\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101869\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "b110de1e4b29426ec4579a5529b15df972b5ce4c", "tree": "2a38be6684c8eb392ae3c5d345fcc5e40cc4af29", "parents": [ "b7698d190a815bfe1b7af5cbea46606b2968a574" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Aug 27 15:29:25 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 27 14:20:24 2026 -0700" }, "message": "runner: Clear remaining warnings from gopls\n\nThis clears some of the sea of yellow in my editor:\n\n- WriteTo collided with a method in some common interface\n- foo.Sub(time.Now()) now has a time.Until() helper\n- byte(foo) \u003e\u003e 8 should have been byte(foo \u003e\u003e 8)\n- Some constant lacked a type\n- Unused function\n\nChange-Id: Ie5d6e53aa5988deaec8f9fdf9db90be4eb593e90\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101868\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "b7698d190a815bfe1b7af5cbea46606b2968a574", "tree": "cf6da3f45d41a3c36eb78d0c2d6db57379712f18", "parents": [ "193233b86d6cbbc20ce30c06a8775311c11be0c4" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Aug 27 15:17:34 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 27 13:29:40 2026 -0700" }, "message": "runner: Remove the implicit session ticket behavior\n\nThis is an old fork from the Go crypto/tls library, where a Config\nobject would lazily fill in a random session ticket key on first use. As\na result, a Config has a private sync.Once in it.\n\nThis causes a ton of warnings about not being allowed to copy a Config.\nBut since we\u0027re managing session ticket keys by hand anyway, we\u0027re not\ngetting anything out of this. Just fill it in ourselves. A separation\nbetween a pure data \"config\" and live stateful \"context\" that you\nconstruct from the \"config\" might have been better in hindsight, but ah\nwell.\n\nFor tidiness, so we don\u0027t accidentally use an all zero key if we don\u0027t\nconfigure it first (not that we care for a testing stack), switch to a\n*[32]byte so that we can check if it\u0027s unset. It being unset is always a\nbug, so just panic when missing.\n\nWhile I\u0027m here, consistently use io.ReadFull to draw from config.rand().\n\nChange-Id: Ie0cb9fe042fcf1e84807a3e31ac1d86fcb3b48b9\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101867\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "193233b86d6cbbc20ce30c06a8775311c11be0c4", "tree": "a80ff2e11dc50f967fb3f1d79d5709e2d3adc09d", "parents": [ "997bafbf73886ec19ac3eb70b31db64fe42832c3" ], "author": { "name": "Moss Hsu", "email": "cheerful.2318@gmail.com", "time": "Wed Aug 26 15:24:39 2026 +0800" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 27 13:17:26 2026 -0700" }, "message": "ACVP: test SLH-DSA-SHAKE-256f.\n\nThe existing SLH-DSA ACVP fixture only covers SHA2-128s. Add a\nfocused NIST demo fixture for SHAKE-256f, covering keyGen,\ndeterministic and non-deterministic sigGen, and valid and invalid\nsigVer cases.\n\nThe complete response was accepted by the NIST demo server before\ntrimming. Keep these cases separate from SLH-DSA.bz2 so the SHAKE\nintegration path stays explicit without replacing the existing SHA2\ncoverage.\n\nChange-Id: I991b50cc4536ad1011478ea6a5f4120ef3beea82\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101767\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "997bafbf73886ec19ac3eb70b31db64fe42832c3", "tree": "ef6ae4ed9633382a03f55362a50b75789c04a0cc", "parents": [ "9e1c47255154b026b7662b307f2fc669b7dee509" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Aug 26 12:38:41 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 27 13:12:34 2026 -0700" }, "message": "Gate VAES codepaths on is_hwaes to fix a theoretical concern\n\nThis is a theoretical concern because no x86 CPU has VAES without\nAES-NI. However, since we have the testing-only environment variable, it\nis in theory possible for someone to set the wrong thing.\n\nThis is easy enough to add, so we may as well, but we do not, in\ngeneral, consider unreasonable CPUIDs to be in scope. (There are other\nenvironment variables like LD_PRELOAD that do even more uncontrolled\nthings! And reruning tests across every possible fake CPUID is\nunreasonable. At least real CPUIDs are bounded.)\n\nI\u0027ve filed crbug.com/552976703 to consider whether we want to keep this\nthing.\n\nFixed: 552666770\nChange-Id: Ie5909ffb953f97286fba7b61ab09a5a436a0cef4\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101787\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "9e1c47255154b026b7662b307f2fc669b7dee509", "tree": "bc0841d772ac09f68964871cd361551f93ae1bc0", "parents": [ "440b43a923501d695b3032670ff228d19b535287" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Thu Aug 20 22:29:58 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 26 15:01:18 2026 -0700" }, "message": "Use traits structs for StackAllocated and StackAllocatedMovable\n\nThis CL refactors StackAllocated{,Movable} to take the init/cleanup/move\nfunction pointers wrapped in a Traits struct (as a typename template\nargument) rather than directly as non-type template arguments, to work\naround a build issue(*), and it makes the code perhaps marginally\ncleaner.\n\n(*) When function pointers are passed directly as non-type template\narguments to StackAllocated / StackAllocatedMovable, clang under\n-gsimple-template-names generates DW_TAG_template_value_parameter\nrelocations in .debug_info pointing directly to those functions. If the\ntype instantiated by the template has internal init/cleanup functions,\nand is used across a shared library boundary, this can cause undefined\nsymbol linker failures because those functions are not exported, even if\nthe type is never constructed or destroyed. This occurs in some\nconfigurations for Chromium\u0027s component build.\n\nBug: 549361069\nCq-Include-Trybots: luci.boringssl.try:linux_clang_shared_compile,linux_clang_shared_rel_compile\nChange-Id: I0cf796458f50509e99158d2625a7d3e26a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101527\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "440b43a923501d695b3032670ff228d19b535287", "tree": "d855ab02366de41574f6b0e30e6ab8289375bea9", "parents": [ "0f073746dfcd04b43d7782770c80baf991c87ffe" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Aug 18 22:07:38 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 26 08:49:41 2026 -0700" }, "message": "Constant-time validation for hash-to-curve, etc\n\nThese functions are meant to run in time independent of their input.\n\nBug: 525105943\nChange-Id: Ib1795fea39d517873d6782d6cb89a3328752c202\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101168\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "0f073746dfcd04b43d7782770c80baf991c87ffe", "tree": "29068abd1870194a649e89dfcd89a4a0f4d1d222", "parents": [ "b8ea4d58f70ca892c882c787f3040cf77735cfe2" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Aug 25 18:28:00 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 26 08:35:00 2026 -0700" }, "message": "Implement EC_wpa3_sae_hunt_and_peck_p256\n\nThis is not a proper hash-to-curve scheme since WPA3 messed it up.\nBecause they messed it up, implementations have to make a lot of fussy\ncode timing-sensitive that they otherwise wouldn\u0027t have to.\n\nBug: 525105943\nChange-Id: Ib1b2db38ee6c433aa0869e7ec48870c5a954ce7e\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101188\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "b8ea4d58f70ca892c882c787f3040cf77735cfe2", "tree": "80c029fe769b7bd8fcf268b5353d14fdf76d673c", "parents": [ "789ccba3db6314d9e24e97ea9e96e4dcf28c2345" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Aug 18 17:43:18 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 26 08:14:50 2026 -0700" }, "message": "Move more of EC compressed coordinate handling to EC_FELEM\n\nDecoding compressed coordinates is not supposed to be timing-sensitive,\nbut the WPA3 folks messed up their PAKE the first time around.\nImplementations are stuck implementing that one, so make the core of the\n3 mod 4 mod_sqrt code for EC constant-time.\n\nThe next CL will use this in IEEE Std 802.11-2020, Section 12.4.4.2.2.\n\nBug: 525105943\nChange-Id: I8330dd06fcb90e9ae3e4d91d89000503d4f1f3ce\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101187\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "789ccba3db6314d9e24e97ea9e96e4dcf28c2345", "tree": "ca48f046fcbdfc59cbbf545baef029481f8f67ce", "parents": [ "eb80152ed1501ba1b2b5d5e39768aa1bc177abcc" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Tue Aug 25 16:08:03 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 09:57:33 2026 -0700" }, "message": "Const correct SSL{_CTX}_get_ciphers calls\n\nFix callers within the library that need const.\n\nBug: 550501994\nChange-Id: I164f7bc561cc11dc87455ff0f0f7afe06a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101747\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "eb80152ed1501ba1b2b5d5e39768aa1bc177abcc", "tree": "7f4b8624db831076eeb8a4607aeac82491f47819", "parents": [ "5178dcb95393e2e61c73390846949cd0af1f6055" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Tue Aug 25 03:20:53 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 09:23:12 2026 -0700" }, "message": "CI console: Specify category and short_name explicitly for all builders\n\nThis removes get_category and get_short_name from main.star. These tag\nheuristics may cause naming conflicts based on stale assumptions.\n\nInstead, explicitly define category and short_name for each builder.\nThis is more readable and avoids implicit logic, per\ninfra/config/README.md.\n\nThis is a refactor only and does not generate any diffs in the generated\nconfigs.\n\nChange-Id: Ie28c28e8c7438591c99eeb8d685899ff6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101647\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "5178dcb95393e2e61c73390846949cd0af1f6055", "tree": "f5e64d19fa5047437302b7164aaacb4c5da33e23", "parents": [ "1672ef359de9c0c81e09f0ec97bb613d3c3826dc" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon Aug 24 21:00:54 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 08:56:46 2026 -0700" }, "message": "rust: Allow panic! and expect()\n\nThese two lints are not serving us right because we actually provide\ngood justification as to why we want to panic to prevent further damage.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I902775acb44b2ec3c0df7350cca611e96a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101627\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "1672ef359de9c0c81e09f0ec97bb613d3c3826dc", "tree": "e6ac40ef57101fb277997ddbfbee66bf369477d3", "parents": [ "c6ff8e4beac4f651881820669d1d9c76d3f2faf4" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Tue Aug 25 08:37:58 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 08:56:36 2026 -0700" }, "message": "rust: bssl-tls: Unstage wants_data\n\nThis function has been accidentally added from a list of deprecated functions.\n\nUpdate-Note: If you happen to depend on this function, please use the\nreturn value of do_handshake, sync_read, sync_write and peek instead.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I43bd4f5a5ff4b2ddf166a28aca33b1b16a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101667\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "c6ff8e4beac4f651881820669d1d9c76d3f2faf4", "tree": "f391ddfe11d5cac03b64d6993befddd437510451", "parents": [ "7445debaaac66522eaa1db3d8ff1ebcb40e1c0c2" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Aug 25 11:31:39 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 08:49:04 2026 -0700" }, "message": "Update some Go deps\n\nSadly the GCS support in acvptool means that we have to churn a ton of\notherwise unnecessary Cloud dependencies.\n\nFixed: 552336428\nChange-Id: Iad3fecf1aaf3960d01617568aa439beb95b8ceab\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101727\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "7445debaaac66522eaa1db3d8ff1ebcb40e1c0c2", "tree": "7f8f3b135310d6894be932092b1f819b0f539806", "parents": [ "a19986331f312d1a85bafef4264a75bd8173a0ca" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Aug 25 11:14:42 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 08:37:35 2026 -0700" }, "message": "OpenSSL Advisory: August 25th, 2026 (BoringSSL Not Affected)\n\nBoringSSL counterpart to\nhttps://openssl-library.org/news/secadv/20260825.txt\n\nChange-Id: I1548db57586757cb8d2bc3cc618028596dfd3ea1\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101707\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "a19986331f312d1a85bafef4264a75bd8173a0ca", "tree": "5cff62f05fc500db55dab0d3b2861082aa918da3", "parents": [ "385a112a349d27bcc20cd72c368dd1336555edd2" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 24 23:24:51 2026 -0700" }, "message": "rust: bssl-tls: Drive handshake to completion\n\nFor sync connectors and acceptors, we should drive handshake to\ncompletion to match those connectors and acceptors from other crates as\nconvention.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ibf9d16e53f4ba463c3d900f24d5aeec76a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101414\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "385a112a349d27bcc20cd72c368dd1336555edd2", "tree": "7a0f02f01aaf49854ffc737fbbd64cecef17fc04", "parents": [ "c5cbc0f9106cc2b33f028ce87c4083904edc42e6" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 21 18:45:45 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 24 13:42:44 2026 -0700" }, "message": "Tighten up SSLCipherPreferenceList\n\nSome minor tweaks with no intended functional changes, in preparation\nfor using SSLCipherPreferenceList for TLS 1.3 ciphers as well.\n\nBug: 545123692\nChange-Id: I1d7ad9942c2651feb02ebbd626a63a726a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101568\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "c5cbc0f9106cc2b33f028ce87c4083904edc42e6", "tree": "c732917559670834813d8811e4ff5166013ccfd2", "parents": [ "269525eb7fcf610b8f9985f3de08d658bbd83f84" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 21 21:12:09 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 24 12:32:58 2026 -0700" }, "message": "Remove SSL{_CTX}_set_aes_hw_override_for_testing\n\nAllowing the AES hardware-based selection of default TLS 1.3 cipher\nsuites to change at runtime complicates the configuration of TLS 1.3\ncipher suites. Remove this seemingly unused mechanism to simplify the\nimplementation of a more robust/flexible configuration mechanism that\nshould supersede this anyway.\n\nUpdate-Note: This removes SSL{_CTX}_set_aes_hw_override_for_testing.\n\nBug: 545123692\nChange-Id: I601141b7aa5cb9825512825c4739626e6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101567\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "269525eb7fcf610b8f9985f3de08d658bbd83f84", "tree": "52a89ea7f3b0efc5dfc4517051a6ef25a3b57279", "parents": [ "7496006103890fdd58b4c923e741692688b13415" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 21 21:35:23 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 24 07:25:55 2026 -0700" }, "message": "CI/CQ: Promote linux_clang_shared_{rel_}compile to CQ and CI\n\nChange-Id: Ia336883296056ba496fa2a8429ff2bec6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101587\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "7496006103890fdd58b4c923e741692688b13415", "tree": "c55a60bd1210068e8f02ae0e226547d989e6586d", "parents": [ "fc3c79cfb7a858d8c4d4c62773a410f4c7579917" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Sun Aug 23 01:10:23 2026 -0700" }, "message": "rust: bssl-tls: Call inherent flush when flushing through std io trait\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I4f285255134906b8a4004569071d12156a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101412\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "fc3c79cfb7a858d8c4d4c62773a410f4c7579917", "tree": "38852fe6c0aa7b03316c4eefb25ea88eca00c0bf", "parents": [ "a0689af29e8e460f1e5380e0fb74cef1b342e810" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Sun Aug 23 01:07:07 2026 -0700" }, "message": "rust: bssl-tls: parse_all_from_pem should recover from BIO failure\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I7cf2f800ad74f3624f840066f43c931f6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101411\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "a0689af29e8e460f1e5380e0fb74cef1b342e810", "tree": "2d5917542814a8655f1ac85624016f2f9129aa82", "parents": [ "aebe361280f2c4afd7426815002e354ff02a4ce1" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Fri Aug 21 05:03:10 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 21 08:52:38 2026 -0700" }, "message": "Add two compatibility headers for code written against current OpenSSL.\n\nJust reduces the load of conditional includes a little for a total of 4\nprojects.\n\nNo other OpenSSL includes exist that could be reasonably made a\nforwarding include and that are actually in use.\n\nBug: 497675628\nChange-Id: I2cf195bdc5546c4a8953dfcec88bb43a6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101547\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "aebe361280f2c4afd7426815002e354ff02a4ce1", "tree": "0ab043d966f9b5184e9881b92ebb0fa9e2391700", "parents": [ "6b1d1d4df9808de168fe3e16327e928fadd3dd57" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 21 01:49:26 2026 -0700" }, "message": "rust: bssl-tls: Session attachment should only be possible in builder\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Idaf6edb154cded0fab3764d0aef1578c6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101410\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "6b1d1d4df9808de168fe3e16327e928fadd3dd57", "tree": "2af41a99f8f765e773fad2ab3b7194626998ad9f", "parents": [ "f0e21a53342b98fd94fa4d10c7179689e060ef0a" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 21 01:44:33 2026 -0700" }, "message": "rust: bssl-tls: Drop the async private key task\n\n... as soon as it is resolved.\n\nFor `async` private key delegate users there is no observable effect,\nbut the destructor is unnecessarily delayed even when the task is\nresolved to some result.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ia06e14cced35d66dac3892ecf37acc836a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101409\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "f0e21a53342b98fd94fa4d10c7179689e060ef0a", "tree": "d4390cb591ca9188d815985ee346aebb1c6ee8b4", "parents": [ "d4c457d3ad70abccb82e9079de195989e60901b6" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Thu Aug 20 09:39:24 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 15:21:18 2026 -0700" }, "message": "Reland \"crypto/x509: Verify standalone Merkle Tree Certs (MTCs)\"\n\nThis reverts commit 96a007fb323e49e5637e018f7f4927addd851d6f,\nthus relanding commit f89068d3030374395c4b070838d1f4d9bbef5465.\n\nThe build failure in Chromium\u0027s component build was because accessing\nimpl-\u003etbs_sig_alg.get() instantiates the StackAllocated\u003cX509_ALGOR, ...\u003e\ntemplate, which emits relocations for internal symbols (x509_algor_init\nand x509_algor_cleanup), and these are not pruned in unoptimized mode.\n\nThe fix (diff from patchset 1) is to avoid reaching into X509Impl\ninternals to construct the test cert. Instead, all the desired\n(intentionally invalid) test certs were generated by the MTC demo tool,\nand checked in as testdata and parsed directly.\n\nOriginal change\u0027s description:\n\u003e Revert \"crypto/x509: Verify standalone Merkle Tree Certs (MTCs)\"\n\u003e\n\u003e This reverts commit f89068d3030374395c4b070838d1f4d9bbef5465.\n\u003e\n\u003e Reason for revert: build failure crbug.com/549361069\n\u003e\n\u003e Failure Link: https://ci.chromium.org/ui/p/chrome/builders/try/linux-chrome-dbg-cog-cache-warmer/79105/overview\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e crypto/x509: Verify standalone Merkle Tree Certs (MTCs)\n\u003e \u003e\n\u003e \u003e This implements verification of \"standalone\" Merkle Tree Certs (see\n\u003e \u003e draft-ietf-plants-merkle-tree-certs-05, section 6.3) as part of the\n\u003e \u003e X509_STORE_CTX API, if the flag X509_V_FLAG_USE_MTC_DRAFT_PLANTS_05\n\u003e \u003e is specified.\n\u003e \u003e\n\u003e \u003e Bug: 503746594\n\u003e \u003e Change-Id: Ie5abd17eb34c37139d3be1261e1914976a6a6964\n\u003e \u003e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100707\n\u003e \u003e Reviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n\u003e \u003e Commit-Queue: Lily Chen \u003cchlily@google.com\u003e\n\u003e \u003e Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n\u003e\n\u003e TBR\u003ddavidben@google.com,boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com,chlily@google.com\n\u003e\n\u003e No-Presubmit: true\n\u003e No-Tree-Checks: true\n\u003e No-Try: true\n\u003e Bug: 503746594, 549361069\n\u003e Change-Id: If43293ba7c2199a463a98dcf848fcc60bdd1e9bb\n\u003e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101307\n\u003e Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n\u003e Auto-Submit: Lily Chen \u003cchlily@google.com\u003e\n\u003e Reviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n\u003e Commit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n\n# Not skipping CQ checks because this is a reland.\n\nBug: 503746594\nCq-Include-Trybots: luci.boringssl.try:linux_clang_shared_compile,linux_clang_shared_rel_compile\nChange-Id: I2376b492ecc0e6bfcfc0acb36cc0f1511dd29db7\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101467\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "d4c457d3ad70abccb82e9079de195989e60901b6", "tree": "b27671aef59d1eaca1167b30ac23707ae9e2853b", "parents": [ "c0e441916a3960cbf5c44a3de4c465f91d8cde75" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Thu Aug 20 20:39:34 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 14:21:04 2026 -0700" }, "message": "CI/CQ: Test clang shared library builds on Linux\n\nTo catch compile issues that may occur in e.g. Chromium\u0027s\ncomponent build.\n\nBug: 549361069\nChange-Id: I137310219922a6db07b401d3167d78fe6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101487\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "c0e441916a3960cbf5c44a3de4c465f91d8cde75", "tree": "03fff8ca89b1b0fb805bd01647375645d9f4695b", "parents": [ "91a7e30bf3729b1a8c1a32b20452228f1a403982" ], "author": { "name": "Moss Hsu", "email": "cheerful.2318@gmail.com", "time": "Thu Aug 20 15:51:08 2026 +0800" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 09:42:36 2026 -0700" }, "message": "ACVP: test non-canonical ML-KEM keys.\n\nThe existing ML-KEM ACVP fixture only covers valid encapsulation\nkeys. Older NIST-generated invalid keys had unintended lengths, so\nthey did not exercise rejection of non-canonical polynomial\ncoefficients.\n\nAdd a focused NIST demo fixture for ML-KEM-768 and ML-KEM-1024.\nEach parameter set includes a valid key and a correctly sized invalid\nkey whose first coefficient is 3330, outside the canonical range 0\nthrough 3328.\n\nThe full response was accepted by the NIST demo server before\ntrimming. Keep these cases separate from ML-KEM.bz2 so the regression\nstays explicit without replacing unrelated ML-KEM coverage.\n\nChange-Id: Ic31b4a843b53d8749a3cf3d6a6a56f777152a8de\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101367\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\n" }, { "commit": "91a7e30bf3729b1a8c1a32b20452228f1a403982", "tree": "9903dd7b130921d9c6aee7dffb9fa356cb5154a7", "parents": [ "17645ee699546479e6ea9f6bae3538dd12f1ab0c" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 07:14:36 2026 -0700" }, "message": "rust: bssl-tls: Eliminate ambiguity on transport state\n\n... when transport is not set yet.\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I2d1274bdc31bc250e3f95316c119b9686a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101408\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "17645ee699546479e6ea9f6bae3538dd12f1ab0c", "tree": "b0110c34b72275b67f06b7faabe61c41d57d98d2", "parents": [ "179af5abdbf5aeba9c71a082126639b8d872af0a" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Thu Aug 20 07:22:46 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 06:25:18 2026 -0700" }, "message": "rust: bssl-tls: Fix flush protocol\n\nThere are two problems with the current BIO flush implementation.\n- We did not signal retry correctly during flushing\n- We did not test the retry reason correctly per specification\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Iff3a922dec08579740edfe9882fd74a36a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101407\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "179af5abdbf5aeba9c71a082126639b8d872af0a", "tree": "17c5807b6739778aea09d49d44e5d7f657fafd4e", "parents": [ "96a007fb323e49e5637e018f7f4927addd851d6f" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Thu Aug 20 00:01:42 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 00:21:52 2026 -0700" }, "message": "CQ: enable `ios64_prefixed_compile` by default.\n\nIt\u0027s not actually redundant with `mac_arm64_prefixed_compile`, because\nthey seem to run vastly different Clang versions:\n\n- `ios64_prefixed_compile` seems to be Clang 13 and Clang 15, depending\n on builder.\n- `mac_arm64_prefixed_compile` seems to be Clang 17 right now.\n\nChange-Id: Ic2e62d88c35a29100cf7c590e292d8876a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101347\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "96a007fb323e49e5637e018f7f4927addd851d6f", "tree": "02d699349eb53339685a897046daa68326158c59", "parents": [ "6f95ff371683db6273ed0108e4f0e6f014d10466" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Wed Aug 19 20:26:56 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 20:29:34 2026 -0700" }, "message": "Revert \"crypto/x509: Verify standalone Merkle Tree Certs (MTCs)\"\n\nThis reverts commit f89068d3030374395c4b070838d1f4d9bbef5465.\n\nReason for revert: build failure crbug.com/549361069\n\nFailure Link: https://ci.chromium.org/ui/p/chrome/builders/try/linux-chrome-dbg-cog-cache-warmer/79105/overview\n\nOriginal change\u0027s description:\n\u003e crypto/x509: Verify standalone Merkle Tree Certs (MTCs)\n\u003e\n\u003e This implements verification of \"standalone\" Merkle Tree Certs (see\n\u003e draft-ietf-plants-merkle-tree-certs-05, section 6.3) as part of the\n\u003e X509_STORE_CTX API, if the flag X509_V_FLAG_USE_MTC_DRAFT_PLANTS_05\n\u003e is specified.\n\u003e\n\u003e Bug: 503746594\n\u003e Change-Id: Ie5abd17eb34c37139d3be1261e1914976a6a6964\n\u003e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100707\n\u003e Reviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n\u003e Commit-Queue: Lily Chen \u003cchlily@google.com\u003e\n\u003e Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n\nTBR\u003ddavidben@google.com,boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com,chlily@google.com\n\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nBug: 503746594, 549361069\nChange-Id: If43293ba7c2199a463a98dcf848fcc60bdd1e9bb\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101307\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "6f95ff371683db6273ed0108e4f0e6f014d10466", "tree": "393bc9e48b726727e041ed8ebbb50db6c2c5b4a5", "parents": [ "f89068d3030374395c4b070838d1f4d9bbef5465" ], "author": { "name": "Matt Mueller", "email": "mattm@google.com", "time": "Wed Aug 19 16:24:21 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 16:55:15 2026 -0700" }, "message": "[MTCs] add debug logs in VerifyMTC\n\nBug: 548629159\nChange-Id: Id3f21d1f6a6dfca3cc89c25f4cf38bb2acf51de2\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101287\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Matt Mueller \u003cmattm@google.com\u003e\n" }, { "commit": "f89068d3030374395c4b070838d1f4d9bbef5465", "tree": "67412502bbd88917d28155badbe64b5cb4d55f27", "parents": [ "42f9f5cd2fa8e973911f64defcd90146fd7d2f3a" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Mon May 18 17:00:22 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 12:49:01 2026 -0700" }, "message": "crypto/x509: Verify standalone Merkle Tree Certs (MTCs)\n\nThis implements verification of \"standalone\" Merkle Tree Certs (see\ndraft-ietf-plants-merkle-tree-certs-05, section 6.3) as part of the\nX509_STORE_CTX API, if the flag X509_V_FLAG_USE_MTC_DRAFT_PLANTS_05\nis specified.\n\nBug: 503746594\nChange-Id: Ie5abd17eb34c37139d3be1261e1914976a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100707\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "42f9f5cd2fa8e973911f64defcd90146fd7d2f3a", "tree": "afa24c69c4c286e156d5a83eb85bb96c20211b2c", "parents": [ "496f8390c6e744d717ae77256a059b9813101906" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Wed Aug 19 14:04:53 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 11:26:32 2026 -0700" }, "message": "Silence a false positive from audit_symbols.go\n\nMSVC is not the only one that uses ceil in std::unordered_map and\nsometimes the symbol is C++-mangled. It seems this was not caught due to\na mishap where a fragile check was added to CI but not CQ.\n\nBug: 544576498\nChange-Id: Id9072a60a82ca3a2bc9297bbf857913e0e673e04\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101267\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "496f8390c6e744d717ae77256a059b9813101906", "tree": "eef647d82a2a67a66399f649924e6db0c23699ab", "parents": [ "da182b2afcea3677f726e708ac5e53eea6760781" ], "author": { "name": "Matt Mueller", "email": "mattm@google.com", "time": "Wed Aug 19 10:19:44 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 10:41:19 2026 -0700" }, "message": "[MTCs] remove draft-davidben-08 support\n\nChange-Id: Ic579f39bc37251ee7df7d50fcaf35f5c730aba86\nBug: 520071497\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101128\nCommit-Queue: Matt Mueller \u003cmattm@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "da182b2afcea3677f726e708ac5e53eea6760781", "tree": "d18eddbd4fce1dbcddb077501e1213f91dd56d95", "parents": [ "2bf5d45e01c3b72ca77e013334707cf3573011f3" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed Aug 19 05:12:43 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 09:10:13 2026 -0700" }, "message": "Add `X509_V_FLAG_ALLOW_TIMEZONE_OFFSET`.\n\nThis relaxes X.509 comparisons to allow for a time zone offset in\n`notBefore` and `notAfter` fields.\n\nBug: 537625888\nChange-Id: I1f51b59816ed4ceaff6ac9e9411d8cf86a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101247\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "2bf5d45e01c3b72ca77e013334707cf3573011f3", "tree": "4a846507b246821686f7dbfd8880b319a4e0d75d", "parents": [ "ca53eec53d88ef6fca80e02cb04f1f9aad00794e" ], "author": { "name": "Moss Hsu", "email": "cheerful.2318@gmail.com", "time": "Wed Aug 19 15:12:05 2026 +0800" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 08:40:33 2026 -0700" }, "message": "Document ML-KEM key check wrapper commands\n\nThe module wrapper implements ML-KEM encapsulation and\ndecapsulation key checks, but the ACVP protocol command table does\nnot list them.\n\nAdd both commands and document the validity flag encoding for wrapper\nimplementations.\n\nChange-Id: Ifcf21967d91158b15da94a3272b7bccc19e41dfe\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101207\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "ca53eec53d88ef6fca80e02cb04f1f9aad00794e", "tree": "8999e5c4e1efe6c8bd48bc5beb4dd76dc3945eb5", "parents": [ "d9cace2c916914c437a10bf987017ba7792c0d57" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Wed Aug 19 01:29:09 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 05:24:52 2026 -0700" }, "message": "compare_benchmark: fix ops/sec output.\n\nThe proper formula for a µs benchmark is not:\n\n`time.Microsecond / cpuTimeUS`\n\nbut:\n\n`time.Second / (cpuTimeUS * time.Microsecond)`\n\nwhich simplifies to:\n\n`(time.Second / time.Microsecond) / cpuTimeUS`\n\nChange-Id: Ibec07cd968e44ea296175a4028f97a2b6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101227\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "d9cace2c916914c437a10bf987017ba7792c0d57", "tree": "28327ad4ad2caa083c556634647d97e3c9b9a947", "parents": [ "962ef49ea9d7b49f0d187ba74e0fa3bec60150dc" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 00:48:06 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 00:18:30 2026 -0700" }, "message": "Fix symbol prefixing audit for libdecrepit and libpki.\n\nlibssl still to be done.\n\nBug: 544576498\nChange-Id: I8f0e3c8e22bb155e1893be6c7723f2646a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100553\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "962ef49ea9d7b49f0d187ba74e0fa3bec60150dc", "tree": "a742dd31d4a5c2f7e632731e3376c5f4d62c1603", "parents": [ "a91822153a309e9d1bfc2c5cc4552a848525db73" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon Aug 10 14:38:54 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 00:15:23 2026 -0700" }, "message": "rust: bssl-tls-tokio: Hyper I/O traits\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: Ib35fe2e377ddbbed2837d480e44066906a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100687\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "a91822153a309e9d1bfc2c5cc4552a848525db73", "tree": "86565604f06c04ab32538c0bbb26008a112961b4", "parents": [ "51da97bd7194c8bda25ea6575b860e759353d6f3" ], "author": { "name": "Matt Mueller", "email": "mattm@google.com", "time": "Tue Aug 18 14:42:52 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 18 15:58:51 2026 -0700" }, "message": "[MTCs] update some tests to draft-plants-04\n\nThere were some tests that only tested the draft-davidben-08 path.\nUpdate them to plants-04. Since this CL is in preparation for removing\nsupport for the old draft entirely, it just updates the tests in-place\nrather than adding tests for both drafts.\n\nChange-Id: I94688573b989d4cefb524ef05c585decc731f6bc\nBug: 520071497\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101127\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Matt Mueller \u003cmattm@google.com\u003e\n" }, { "commit": "51da97bd7194c8bda25ea6575b860e759353d6f3", "tree": "ca4a59657d0bd35c67b5ef6d67b3e7e66d65b34c", "parents": [ "af1e417c4c1672a9c3b7302ca7cb1f52aac34ad0" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Wed Aug 12 10:01:47 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 18 13:40:52 2026 -0700" }, "message": "rust: bssl-tls: Async polling I/Os and Datagrams\n\nAs we prepare `bssl-tls-tokio`, we are ready to publish the functions\nfor performing `async` I/O as public APIs.\n\n\nUpdate-Note: DTLS I/O APIs have been not functional fully, but if it\nhas worked so far, please migrate to the new {a,}sync_{send, recv} APIs\nfor they are semantically different from stream sockets.\n\nBug: 532601068\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I3f2d7b21f513acbb6f09c4167997058c6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100847\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n" }, { "commit": "af1e417c4c1672a9c3b7302ca7cb1f52aac34ad0", "tree": "825f2150570d3a6e346ceca33bb29db9280b2c38", "parents": [ "19c562ed7eb69df5d739cbb808c0bad460edae43" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 17 01:13:24 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 18 08:57:38 2026 -0700" }, "message": "Rename ECDH benchmark -\u003e ECDHComputeKey and add ECDHKeyGen.\n\nThis makes clearer what the benchmarks measure, and also allows tracking\nkeygen performance separately as well.\n\nThis is a follow-up to commit ed2f7e8c26006ff9284279702708797b46d590d6.\n\nOverview:\n\n```\n--------------------------------------------------------------------------------\nBenchmark Time CPU Iterations\n--------------------------------------------------------------------------------\nBM_SpeedECDHKeyGen/p224/threads:1 86029 ns 86029 ns 8127\nBM_SpeedECDHKeyGen/p256/threads:1 7060 ns 7058 ns 98374\nBM_SpeedECDHKeyGen/p384/threads:1 309585 ns 309301 ns 2267\nBM_SpeedECDHKeyGen/p521/threads:1 776386 ns 775704 ns 899\nBM_SpeedECDHComputeKey/p224/threads:1 91222 ns 91195 ns 7664\nBM_SpeedECDHComputeKey/p256/threads:1 39382 ns 39329 ns 17586\nBM_SpeedECDHComputeKey/p384/threads:1 333345 ns 333123 ns 2092\nBM_SpeedECDHComputeKey/p521/threads:1 848211 ns 846023 ns 828\nBM_SpeedECDHEphemeral/p224/threads:1 183712 ns 183670 ns 3809\nBM_SpeedECDHEphemeral/p256/threads:1 50315 ns 50290 ns 13886\nBM_SpeedECDHEphemeral/p384/threads:1 666594 ns 666588 ns 1046\nBM_SpeedECDHEphemeral/p521/threads:1 1692489 ns 1692147 ns 414\n```\n\nChange-Id: I562a6b51dd4d75dc559a70375b437f416a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101087\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "19c562ed7eb69df5d739cbb808c0bad460edae43", "tree": "c66e12e23d3baab899c97eb6b73ba0835e936ceb", "parents": [ "42119772e91173141f359187deab8daaf2f7e286" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Tue Aug 11 00:11:09 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 18 07:36:13 2026 -0700" }, "message": "Remove CRYPTO_IOVEC_MAX.\n\nInstead, allocate on the heap when it is exceeded.\n\nThere should already be no more code using the constant in the wild.\n\nBug: 544930636\nChange-Id: I9a84c791e3aae2e451d8b806220cfb636a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100727\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "42119772e91173141f359187deab8daaf2f7e286", "tree": "9fccb6bc1970f0de35b36a35d1fbd4631be62f12", "parents": [ "bb2b3174e6d48a32f07f1f3e100f68f3239ebb3f" ], "author": { "name": "Xiangfei Ding", "email": "xfding@google.com", "time": "Mon Aug 17 13:46:07 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 18 06:33:44 2026 -0700" }, "message": "crypto: format curve25519 internal header\n\nSigned-off-by: Xiangfei Ding \u003cxfding@google.com\u003e\nChange-Id: I179bf6e99ae261df9c6e5d397a0b16b26a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101147\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "bb2b3174e6d48a32f07f1f3e100f68f3239ebb3f", "tree": "d1c024bab7618372b6220aab012c95e0ff02d7d8", "parents": [ "defe5810ee8be430bcdeccf46a199bec0e93abdb" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 00:34:28 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 23:48:33 2026 -0700" }, "message": "CMake: move symbol prefixing check to the run_tests stage.\n\nBug: 543471701\nChange-Id: Ib36d1ee3549b8bc832b221e44694124e6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100552\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "defe5810ee8be430bcdeccf46a199bec0e93abdb", "tree": "1b98e1fb3a5b0d1f3b016c681d955e695019e518", "parents": [ "da0976d6b8b55bfd2ad446c67cb54113b602085c" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon Aug 10 22:53:26 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 09:00:37 2026 -0700" }, "message": "Always enable X509_V_FLAG_TRUSTED_FIRST\n\nNo one seems to ever disable it. This means we can unwind the alt-chains\nlogic, as it\u0027s never used as a result.\n\nAs discussed in\nhttps://boringssl-review.googlesource.com/c/boringssl/+/49746, neither\nmode is really correct. An ideal implementation would be a backtracking\npath builder. But the particular implementation of backtracking in\nalt-chains is both insufficient and particularly messy. Simplify this\nfor now and go from there.\n\nUpdate-Note: X509_V_FLAG_TRUSTED_FIRST is now always enabled. (It was\npreviously a default.) Passing it to X509_VERIFY_PARAM_clear_flags now\ndoes nothing. Running tests suggests no one is relying on this. This\nmeans X509_V_FLAG_NO_ALT_CHAINS is now also a no-op because it does\nnothing when X509_V_FLAG_TRUSTED_FIRST is enabled.\n\nBug: 544895602\nChange-Id: I0b6519f705de2abacea2b6041ae855d59286b631\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100787\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "da0976d6b8b55bfd2ad446c67cb54113b602085c", "tree": "1ba862eca15d51f446bf7d440edcb0462b059ed7", "parents": [ "405168da550d1e8a4ebade85ab9e71e3d4d1a366" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 17 05:40:19 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 06:11:45 2026 -0700" }, "message": "Fix symbol prefixing issues on Windows.\n\nBug: 543471701\nChange-Id: Ia5613245b0409bcfc3ce123801ebbf2f6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101107\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "405168da550d1e8a4ebade85ab9e71e3d4d1a366", "tree": "6fc4761c3b418105098ae2801f3b4816cbc288a3", "parents": [ "7cc6f8ae2c4e7a0befbb38bd5e9f3ff6103c2cd6" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 00:29:00 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 03:52:30 2026 -0700" }, "message": "Enable CI/CQ-based symbol prefixing verification on all Win shared builds.\n\nBug: 543471701\nChange-Id: I9c5b01ca45161b241d119ceed01451ed6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100551\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "7cc6f8ae2c4e7a0befbb38bd5e9f3ff6103c2cd6", "tree": "1934f2193114c9ebdc39f05fe276a44e497b93e1", "parents": [ "90f8d9e98a9aed89a3353d9ab733c77197c7c562" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 00:28:38 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 02:21:15 2026 -0700" }, "message": "Enable CI/CQ-based symbol prefixing verification on all Win static builds.\n\nBug: 543471701\nChange-Id: I11293c070b353875994c954a5ca487c16a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100550\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "90f8d9e98a9aed89a3353d9ab733c77197c7c562", "tree": "5f5266c377b64a23ed19b32ab47419ae1ed00687", "parents": [ "d83fe5d6b22655d90125d5204f0906ae5f848446" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 11:42:48 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 01:49:44 2026 -0700" }, "message": "audit_symbols.go: show the origin (library filename) of offending symbols.\n\nThis is nice when having checked multiple libraries.\n\nBug: 544576498\nChange-Id: I7e363e5d8132f316e358b89232cddd1c6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100667\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "d83fe5d6b22655d90125d5204f0906ae5f848446", "tree": "0e7ab7bd506669839bb28ff0459386d3cb3544d2", "parents": [ "2541aa29437c4315afd469c9838c420414076453" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 00:27:56 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 01:47:04 2026 -0700" }, "message": "Enable CI/CQ-based symbol prefixing verification on all Mac static builds.\n\nBug: 543471701\nChange-Id: Icbcf4a747bf7dfb1c6c35f960e937b006a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100549\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\n" }, { "commit": "2541aa29437c4315afd469c9838c420414076453", "tree": "4d85039b576a351815e7ec721216bb8cea2f78e8", "parents": [ "b0760837957bf86bd2014d258a948ee76f43c83f" ], "author": { "name": "Rudolf Polzer", "email": "rpolzer@google.com", "time": "Mon Aug 10 00:27:13 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 01:05:42 2026 -0700" }, "message": "Enable CI/CQ-based symbol prefixing verification on all Linux static builds.\n\nBug: 543471701\nChange-Id: Ib2515f5b8c4311edd7b9e109b32955cc6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100548\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nCommit-Queue: Rudolf Polzer \u003crpolzer@google.com\u003e\n" }, { "commit": "b0760837957bf86bd2014d258a948ee76f43c83f", "tree": "8934bb26100bb063ecfaf9314ed169df37c4d44e", "parents": [ "30a18e723911bde5446252a5ada0f0b0b09d639b" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 14 19:01:38 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 19:44:21 2026 -0700" }, "message": "crypto/bytestring: Add helper for relative OID from DER to text into CBB\n\nIt is similar to the existing CBS_asn1_relative_oid_to_text, except it\nwrites directly into a CBB rather than allocating a new string.\n\nChange-Id: I2b7d7e1149d49d38ccacd37df4ff3bae6a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101047\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "30a18e723911bde5446252a5ada0f0b0b09d639b", "tree": "2b2fd549211af63bd53702bd191a719a7dc82cfe", "parents": [ "c9aaa8391addb7e1dc7e3b3c24ecc5b446ca1428" ], "author": { "name": "Miriam Polzer", "email": "mpolzer@google.com", "time": "Thu Aug 13 13:13:49 2026 +0200" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 12:53:50 2026 -0700" }, "message": "Add ephemeral ECDH benchmark\n\nThe existing ECDH benchmark only measures raw scalar multiplication\nwith pre-generated keys. Add BM_SpeedECDHEphemeral to mirror the full\nTLS ECDHE key exchange (generating an ephemeral keypair, serializing\nthe public point, parsing the peer\u0027s point, and deriving the padded\nshared secret). This allows direct comparisons against ML-KEM\nbenchmarks.\n\nChange-Id: I0057c1dffb7209891e64c07e20e9570493d8d45a\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100908\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "c9aaa8391addb7e1dc7e3b3c24ecc5b446ca1428", "tree": "901cc8a0ef35c3a6e4fd21031dd31e43a5735b45", "parents": [ "5f1bc734806daf3ee4f8636b48b3fc2364cce25d" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 14 17:28:22 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 11:49:44 2026 -0700" }, "message": "Suppress X509{,_REQ}_get1_email fallback to subject for malformed SAN\n\nThis has no impact on cert validation (a malformed SAN would already\ncause validation to fail), but we might as well suppress the incorrect\nresult.\n\nBug: 491158075\nChange-Id: I51fe41775d61e1143a553530c630c1646a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101027\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "5f1bc734806daf3ee4f8636b48b3fc2364cce25d", "tree": "353ddc05bd3d5598eb841aafe2c891a97eeda89b", "parents": [ "eae46df1e6c1df0556ee4106bcab75657eb8181e" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Fri Aug 14 15:35:33 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 11:46:22 2026 -0700" }, "message": "Fix some IWYU from clang-tidy\n\nChange-Id: I6fac30ad00cb2040b34a70cdf28a1fc46a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100987\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "eae46df1e6c1df0556ee4106bcab75657eb8181e", "tree": "b7dda43aae5448010bb8930c9017837b96a24a10", "parents": [ "3c31f33f61cdb22e48437c4347d17c6cebab1506" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Fri Aug 14 12:52:41 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 10:56:45 2026 -0700" }, "message": "Remove the old F5 padding workaround\n\nMany, many, many eons ago, SSL 2.0 was born.\n\nMany, many eons ago, SSL 3.0 was born. SSL 3.0 was a completely\ndifferent record layer from SSL 3.0. Since then, all versions of TLS\nkept continuity with SSL 3.0 in the record layer and ClientHello.\n\nMany eons ago, F5 shipped a TLS load balancer that supported SSL 2.0 and\nSSL 3.0. As part of that, they had to detect SSL 2.0 and SSL 3.0.\n\nEons ago, ClientHellos started hanging when talking to F5 servers. It\nturned out that, once we made the TLS ClientHello exceed 256 bytes for\nALPN, F5 misinterpeted it as an incomplete SSL 2.0 CLIENT-HELLO and\nhung.\nhttps://mailarchive.ietf.org/arch/msg/tls/8wXwhM1d5WSmROHFSgrTyFmWN2o/\nhttps://www.imperialviolet.org/2013/10/07/f5update.html\n\nIt turned out bumping the size up to 512 bytes would dodge the bug, so\nthe padding extension was born:\nhttps://www.rfc-editor.org/info/rfc7685/\n\nIt has now been almost 10 years. In that time, ClientHellos have gotten\nlarger. With X25519MLKEM768 enabled by default, every ClientHello over\nwell over 1 KiB and the padding is a no-op. Also the F5s have hopefully\ngotten updated.\n\nRemove the padding, which requires some somewhat subtle bookkeeping. In\nparticular, we usually qualify changes with Chromium but as Chromium has\nlong enabled ML-KEM, we have gotten all the signal we ever will get\nabout F5.\n\nUpdate-Note: If there are still unupdated F5s out there, a TLS client\napplication may hang when connecting to them. This would only happen if\nyour application:\n\n1. Bypasses BoringSSL\u0027s default of enabling TLS 1.3, or\n2. Bypasses BoringSSL\u0027s default of enabling X25519MLKEM768\n\nImpacted applications should enable TLS 1.3 and X25519MLKEM768 for\nbetter compatibility and security. Applications using BoringSSLs\ndefaults are not impacted by this change.\n\nFixed: 532111493\nChange-Id: I78fd1d65d9fa7c25347fb56803acd6137f038eae\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101007\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "3c31f33f61cdb22e48437c4347d17c6cebab1506", "tree": "9c85b850478c16db9722cd18a7b28e243ddb1273", "parents": [ "017c345d93f0cc3c1bf7c718dae06bcc2de943a0" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Tue Jul 21 23:47:39 2026 +0200" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 13 16:51:38 2026 -0700" }, "message": "Document the per-encoder method for fixing OpenSSL\u0027s broken defaults\n\nOpenSSL has chosen non-interoperable and unsafe defaults for ML-KEM and\nML-DSA private key serialization. Their only programmatic workaround\nsets options globally.\n\nhttps://github.com/openssl/openssl/pull/29206 added a per-encoder\noption. Document that too.\n\nChange-Id: I266e6c0829d0e0eec6167a0aba1ddae26e5d213b\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99229\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "017c345d93f0cc3c1bf7c718dae06bcc2de943a0", "tree": "86b3e7e9d0c3b75b8e7802402eaa9db4d9dd0fcb", "parents": [ "3dd92389c31ded6fdb6d2492503033498766fe0b" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Tue Jun 30 22:12:47 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 13 14:54:41 2026 -0700" }, "message": "crypto/x509: Add a helper to get cached TBS cert or else marshal it\n\nAs a convenience, to avoid making a copy when possible.\n\nMigrates X509_verify() from the previous helper, which always makes a\ncopy, to the new helper which sometimes avoids a copy.\n\nChange-Id: I76f771e4f0a591fe615fd0162038db866a6a6964\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100450\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\n" }, { "commit": "3dd92389c31ded6fdb6d2492503033498766fe0b", "tree": "6528d2778ff35233fc25cad9c389e47f161f9bcb", "parents": [ "7c1efd8d6ffb36a57feba44e8c73cf674801f3cb" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Thu Aug 13 14:20:06 2026 -0400" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 13 12:16:57 2026 -0700" }, "message": "OpenSSL Advisory: August 13th, 2026 (BoringSSL Not Affected)\n\nBoringSSL counterpart to\nhttps://openssl-library.org/news/secadv/20260813.txt and a discussion on\nhttps://openssl-library.org/post/2026-07-21-hollowbyte/\n\nChange-Id: I67d009e05c74b8112bc336322e8969a597d2df73\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100967\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "7c1efd8d6ffb36a57feba44e8c73cf674801f3cb", "tree": "a848932d085ef537ca66a1e9223d8b814646332a", "parents": [ "6a5f579a231fb4deea39c8474924d6e20c1213bb" ], "author": { "name": "Lily Chen", "email": "chlily@google.com", "time": "Thu Aug 13 07:23:16 2026 -0700" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 13 07:49:24 2026 -0700" }, "message": "Update version for Bazel Central Repository to 0.20260813.0\n\nChange-Id: I3abc78a1df1e226bc905e87e927e18dcf50bbe7f\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100927\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nAuto-Submit: Lily Chen \u003cchlily@google.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "6a5f579a231fb4deea39c8474924d6e20c1213bb", "tree": "47d89a7708a7fd86b44ef660155ba8fa3dc1b654", "parents": [ "ef0c0723156ff8014feb6b6789afe1e43d7e8710" ], "author": { "name": "Stefano Duo", "email": "stefanoduo@google.com", "time": "Thu Aug 13 08:40:21 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 13 07:37:42 2026 -0700" }, "message": "Bump BORINGSSL_API_VERSION\n\nWe forgot to do this in\nhttps://boringssl-review.googlesource.com/c/boringssl/+/99327, when\nSSL_set_reject_unusable_ech_config was introduced.\n\nBug: 542983348, b:450001346\nChange-Id: I98fab742617e58ced47d1d3e7f418e05a0e3f883\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100907\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n" }, { "commit": "ef0c0723156ff8014feb6b6789afe1e43d7e8710", "tree": "c94941b03c14a889412e733be695b1056986f9da", "parents": [ "e5a214a259892b5b9b9384a69d2beb61fb8c3521" ], "author": { "name": "Adam Langley", "email": "agl@imperialviolet.org", "time": "Wed Aug 12 17:49:49 2026 +0000" }, "committer": { "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 12 22:52:50 2026 -0700" }, "message": "Fix ACVP RSA PSS.\n\n305bcfce0 broke ACVP PSS because it didn\u0027t update the expected number of\narguments for the operation in modulewrapper.cc. We didn\u0027t notice\nbecause we didn\u0027t have ACVP tests for RSA signature generation. Fix both\nthings.\n\nChange-Id: Idccd56f8480556c3aa77a8d4ddc856669e03b086\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100887\nReviewed-by: Xiangfei Ding \u003cxfding@google.com\u003e\nAuto-Submit: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: Xiangfei Ding \u003cxfding@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" } ], "next": "e5a214a259892b5b9b9384a69d2beb61fb8c3521" }