Packman Build Service PMBS

boringssl.changes Changed

boringssl.spec Changed

curl-impersonate.patch Added

@@ -0,0 +1,1454 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index bab3d89dd..31be174ce 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -442,7 +442,9 @@ if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
+     # clang-cl sets different default warnings than clang. It also treats -Wall
+     # as -Weverything, to match MSVC. Instead -W3 is the alias for -Wall.
+     # See http://llvm.org/viewvc/llvm-project?view=revision&revision=319116
+-    list(APPEND C_CXX_WARNINGS -W3 -Wno-unused-parameter)
++    # curl-impersonate: Consumers of the fork still build deprecated
++    # compatibility APIs with clang-cl.
++    list(APPEND C_CXX_WARNINGS -W3 -Wno-unused-parameter -Wno-deprecated)
+   else()
+     list(APPEND C_CXX_WARNINGS -Wall)
+   endif()
+@@ -761,8 +763,6 @@ if(FIPS)
+   target_link_libraries(entropy_modulewrapper crypto)
+ endif()
+ 
+-add_executable(bssl ${BSSL_SOURCES})
+-target_link_libraries(bssl ssl crypto)
+ 
+ if(BUILD_TESTING)
+   add_executable(generate_mldsa_certs pki/testdata/verify_unittest/generate_mldsa_certs.cc)
+@@ -864,7 +864,6 @@ endif()
+ 
+ if(INSTALL_ENABLED)
+   install(TARGETS crypto ssl EXPORT OpenSSLTargets)
+-  install(TARGETS bssl)
+   install(DIRECTORY include/ DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+   install(EXPORT OpenSSLTargets
+           FILE OpenSSLTargets.cmake
+diff --git a/crypto/cipher/e_tls.cc b/crypto/cipher/e_tls.cc
+index 0edf61a24..5a8410d34 100644
+--- a/crypto/cipher/e_tls.cc
++++ b/crypto/cipher/e_tls.cc
+@@ -442,6 +442,22 @@ static int aead_aes_256_cbc_sha1_tls_implicit_iv_init(
+                        EVP_sha1(), 1);
+ }
+ 
++static int aead_aes_256_cbc_sha256_tls_init(EVP_AEAD_CTX *ctx,
++                                            const uint8_t *key, size_t key_len,
++                                            size_t tag_len,
++                                            enum evp_aead_direction_t dir) {
++  return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_aes_256_cbc(),
++                       EVP_sha256(), 0);
++}
++
++static int aead_aes_256_cbc_sha384_tls_init(EVP_AEAD_CTX *ctx,
++                                            const uint8_t *key, size_t key_len,
++                                            size_t tag_len,
++                                            enum evp_aead_direction_t dir) {
++  return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_aes_256_cbc(),
++                       EVP_sha384(), 0);
++}
++
+ static int aead_des_ede3_cbc_sha1_tls_init(EVP_AEAD_CTX *ctx,
+                                            const uint8_t *key, size_t key_len,
+                                            size_t tag_len,
+@@ -551,6 +567,38 @@ static const EVP_AEAD aead_aes_256_cbc_sha1_tls_implicit_iv = {
+     aead_tls_tag_len,
+ };
+ 
++static const EVP_AEAD aead_aes_256_cbc_sha256_tls = {
++    SHA256_DIGEST_LENGTH + 32,  // key len (SHA256 + AES256)
++    16,                         // nonce len (IV)
++    16 + SHA256_DIGEST_LENGTH,  // overhead (padding + SHA256)
++    SHA256_DIGEST_LENGTH,       // max tag length
++
++    nullptr,  // init
++    aead_aes_256_cbc_sha256_tls_init,
++    aead_tls_cleanup,
++    aead_tls_openv,
++    aead_tls_sealv,
++    nullptr,  // openv_detached
++    nullptr,  // get_iv
++    aead_tls_tag_len,
++};
++
++static const EVP_AEAD aead_aes_256_cbc_sha384_tls = {
++    SHA384_DIGEST_LENGTH + 32,  // key len (SHA384 + AES256)
++    16,                         // nonce len (IV)
++    16 + SHA384_DIGEST_LENGTH,  // overhead (padding + SHA384)
++    SHA384_DIGEST_LENGTH,       // max tag length
++
++    nullptr,  // init
++    aead_aes_256_cbc_sha384_tls_init,
++    aead_tls_cleanup,
++    aead_tls_openv,
++    aead_tls_sealv,
++    nullptr,  // openv_detached
++    nullptr,  // get_iv
++    aead_tls_tag_len,
++};
++
+ static const EVP_AEAD aead_des_ede3_cbc_sha1_tls = {
+     SHA_DIGEST_LENGTH + 24,  // key len (SHA1 + 3DES)
+     8,                       // nonce len (IV)
+@@ -603,7 +651,15 @@ const EVP_AEAD *EVP_aead_aes_256_cbc_sha1_tls_implicit_iv() {
+   return &aead_aes_256_cbc_sha1_tls_implicit_iv;
+ }
+ 
+-const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls() {
++const EVP_AEAD *EVP_aead_aes_256_cbc_sha256_tls(void) {
++  return &aead_aes_256_cbc_sha256_tls;
++}
++
++const EVP_AEAD *EVP_aead_aes_256_cbc_sha384_tls(void) {
++  return &aead_aes_256_cbc_sha384_tls;
++}
++
++const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls(void) {
+   return &aead_des_ede3_cbc_sha1_tls;
+ }
+ 
+diff --git a/crypto/fipsmodule/ec/p256_test.cc b/crypto/fipsmodule/ec/p256_test.cc
+index a8039c385..3dfbea8fb 100644
+--- a/crypto/fipsmodule/ec/p256_test.cc
++++ b/crypto/fipsmodule/ec/p256_test.cc
+@@ -21,7 +21,7 @@ BSSL_NAMESPACE_BEGIN
+ namespace {
+ 
+ #if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__) && \
+-    defined(SUPPORTS_ABI_TEST)
++    defined(SUPPORTS_ABI_TEST) && !defined(OPENSSL_WINDOWS)
+ extern "C" {
+ #include "../../../third_party/fiat/p256_field.c.inc"
+ }
+diff --git a/crypto/rand/windows.cc b/crypto/rand/windows.cc
+index ebd0d4afd..bf9c75e26 100644
+--- a/crypto/rand/windows.cc
++++ b/crypto/rand/windows.cc
+@@ -60,6 +60,9 @@ void bssl::CRYPTO_sysrand(uint8_t *out, size_t requested) {
+ typedef BOOL(WINAPI *ProcessPrngFunction)(PBYTE pbData, SIZE_T cbData);
+ static ProcessPrngFunction g_processprng_fn = nullptr;
+ 
++typedef BOOL(WINAPI *RtlGenRandomFunction)(PVOID RandomBuffer, ULONG RandomBufferLength);
++static RtlGenRandomFunction g_rtlgenrandom_fn = nullptr;
++
+ static void init_processprng() {
+   HMODULE hmod = LoadLibraryW(L"bcryptprimitives");
+   if (hmod == nullptr) {
+@@ -67,7 +70,14 @@ static void init_processprng() {
+   }
+   g_processprng_fn = (ProcessPrngFunction)GetProcAddress(hmod, "ProcessPrng");
+   if (g_processprng_fn == nullptr) {
+-    abort();
++    hmod = LoadLibraryW(L"advapi32");
++    if (hmod == nullptr) {
++      abort();
++    }
++    g_rtlgenrandom_fn = (RtlGenRandomFunction)GetProcAddress(hmod, "SystemFunction036");
++    if (g_rtlgenrandom_fn == nullptr) {
++      abort();
++    }
+   }
+ }
+ 
+@@ -81,8 +91,22 @@ void bssl::CRYPTO_sysrand(uint8_t *out, size_t requested) {
+   // On non-UWP configurations, use ProcessPrng instead of BCryptGenRandom
+   // to avoid accessing resources that may be unavailable inside the
+   // Chromium sandbox. See https://crbug.com/74242
+-  if (!g_processprng_fn(out, requested)) {
+-    abort();
++  if (g_processprng_fn != NULL) {
++    if (!g_processprng_fn(out, requested)) {
++      abort();
++    }
++  } else {
++    while (requested > 0) {
++      ULONG output_bytes_this_pass = ULONG_MAX;
++      if (requested < output_bytes_this_pass) {
++        output_bytes_this_pass = (ULONG)requested;
++      }
++      if (g_rtlgenrandom_fn(out, output_bytes_this_pass) == FALSE) {
++        abort();
++      }
++      requested -= output_bytes_this_pass;
++      out += output_bytes_this_pass;
++    }
+   }
+ }
+ 
+diff --git a/export.sh b/export.sh
+new file mode 100755
+index 000000000..1baee7908
+--- /dev/null
++++ b/export.sh
+@@ -0,0 +1,8 @@
++#!/bin/bash
++
++# From here: https://chromium.googlesource.com/chromium/src.git/+/refs/tags/135.0.7049.41/DEPS
++
++BASE_COMMIT=156c7b75ae9b8c3b3f847acf264f17594c3859fb
++
++git diff $BASE_COMMIT > boringssl.patch
++mv boringssl.patch ../curl-impersonate/patches/boringssl.patch
+diff --git a/include/openssl/aead.h b/include/openssl/aead.h
+index 6b8ad575a..bae75c629 100644

Changes of Revision 5