Packman Build Service PMBS

boringssl.changes Changed

@@ -1,4 +1,133 @@
 -------------------------------------------------------------------
+Mon Aug 24 14:32:50 UTC 2026 - Fridrich Strba <fridrich.strba@bluewin.ch>
+
+- Update to version 0.20260813:
+  * Update version for Bazel Central Repository to 0.20260813.0
+  * Bump BORINGSSL_API_VERSION
+  * Fix ACVP RSA PSS.
+  * Separate serial number validity from serial number length
+  * crypto/x509: Implement Merkle Tree inclusion proof evaluation
+  * crypto/x509: Add convenience function to verify signature from byte span
+  * Defer allocating reassembly buffers in DTLS
+  * Support cSHAKE and TurboSHAKE.
+  * runner: replace ptrTo with value-based new
+  * Enable `check_prefixed_symbols` on the CI-only prefixed symbols builders.
+  * Fix benchmark names of the IOVec variants.
+  * AEAD benchmarks: add iovec variants.
+  * audit_symbols.go: Default to locating libraries in the CWD.
+  * Add a stub for SSL_get_peer_tmp_key
+  * draft-ietf-tls-ecdhe-mlkem is now RFC 10024
+  * rust: bssl-tls: Unstage the callback uninstallers
+  * Update Rust and Clang.
+  * AEAD benchmarks: declare optimization hints.
+  * Don't unnecessarily tag ssl_cipher_is_deprecated as OPENSSL_EXPORT
+  * Remove OPENSSL_EXPORT on some internal SSL_SESSION functions
+  * Add some bit math helpers
+  * runner: Remove split handshake test machinery from the handshaker
+  * Revert "Work around a NASM bug"
+  * Update nasm in CI to 3.01
+  * rust: Publish the experimental bssl-tls tokio interop crate
+  * rust: bssl-tls-tokio: Rework the tests
+  * rust: bssl-tls: Introduce hyper support
+  * rust: bssl-tls: Add ALPN support
+  * Minor include cleanup.
+  * rust: hoist FFI slice converters to bssl-crypto
+  * Discard .group sections in fips_shared.lds
+  * runner: Remove split handshake tests
+  * rust: Minor nit fixing
+  * rust: Keep future options open through non-exhaustiveness
+  * Re-enable the linux32_sde CI builder.
+  * Unwind EVP_CIPHER_CTX poisoning
+  * Document that EVP_aes_256_xts is single-shot
+  * Bump SDE version.
+  * Make BoringSSL handling of "unusable" EchConfigLists configurable
+  * Disable urandom_test while under SDE.
+  * Remove inconsistent null pointer checks in cipher_update hooks
+  * Delete unused code
+  * bssl-tls: Use more representative test data for cert parsing
+  * acvptool: seed key format for ML-DSA sigGen and ML-KEM decap
+  * Delete the mac_tmp_try_out_cas builder.
+  * Upload all mobile binaries to CAS when building.
+  * rust: bssl-tls: Clean up all slice_from_raw_parts
+  * Upload all Mac binaries to CAS when building.
+  * Upload all Windows binaries to CAS when building.
+  * Upload all Linux binaries to CAS when building.
+  * Linux: also export *.so.* files to CAS.
+  * Remove old Kyber hybrid from the TLS stack
+  * Use the correct file list of the ios64 test build archival.
+  * Improve ECC benchmarks
+  * Prepare for a new BCR release.
+  * Test the remaining "interesting" build configs for LUCI uploads.
+  * Revert "Enable symbol prefixing for the Bazel build"
+  * Run 5 more temporary test configs.
+  * When exporting build artifacts to CAS, reduce to necessary stuff.
+  * rust: bssl-tls: Introduce certificate callback
+  * rust: bssl-tls: Minor typo fix
+  * EVP_CIPHER: only poison the object on failure if it was mutated by the call.
+  * Point CMake more firmly at the `delocate` and `inject_hash` binaries.
+  * rust: bssl-tls: Allow application to get selected credential
+  * ssl: Allow retrospection of PSK identity
+  * Bump Bazel version to 0.20260730.0
+  * rust: bssl-tls: Split Methods trait into connection and context variants
+  * In `linux_tmp_try_out_cas`, explicitly provide list of files to export.
+  * Create a temporary test CQ builder for setting up CAS uploading of artifacts.
+  * Preparation for including asm code from pq-code-package.
+  * TEST_F(BNTest, ModSqrtInvalid): explain what's going on.
+  * Preserve comments in perlasm.
+  * Documentation: add proper section heading for CRYPTO ByteBuilder
+  * rust: bssl-tls: Relax `set_ca_names` to both parties
+  * third_party/fiat: mark as Static
+  * New target: `run_unit_tests`.
+  * Reset the error queue in some more typical cases where unit tests intend to fail.
+  * Enable thread safety annotations in local bazel builds.
+  * rust: bssl-tls: Fix documentation
+  * rust: bssl-tls: RPK with private key methods
+  * Add Threads dependency in exported CMake config file
+  * Add CBB_add_u48
+  * Disable the linux32_sde runner for now.
+  * Enable symbol prefixing for the Bazel build
+  * ssl: Use default ALPN handler
+  * Fix typo in doc
+  * Fix notes on the SDE version on CI
+  * Test runner: when stdout is redirected, assume -pipe.
+  * rust: bssl-tls-tokio: Remove DTLS convenience wrappers
+  * Reset the error queue in some typical cases where unit tests intend to fail.
+  * Add an ErrorsAreAndClear test helper.
+  * rust: bssl-tls: Add cipher type
+  * rust: bssl-tls: Simplify the tests
+  * rust: bssl-tls: Make building a new connection builder infallible
+  * Add EVP-level RSAPublicKey and RSAPrivateKey parsers
+  * Add some EVP APIs for low-level EC point and scalar formats
+  * rust: bssl-tls: Unstage compliance policy
+  * Revamp evp_test key import
+  * draft-ietf-tls-keylogfile is now RFC 9850
+  * Export SLHDSA_generate_key_from_seed to the public API.
+  * rust: bssl-tls: Add convenient adapters
+  * rust: bssl-tls: Refactor the stack iterator
+  * Use EVP_PKEY_generate_from_alg in tool/server.cc
+  * rust: bssl-tls: Introduce non-X.509 mode
+  * ssl: Release the names if `SSL_set0_CA_names` is called after config is shed
+  * rust: bssl-tls: Add controls for CAs
+  * rust: bssl-tls: Make getting internal handle for us easier
+  * rust: bssl-tls: Move DTLS methods into the correct typestate
+  * rust: bssl-tls: Add missing SSL error codes
+  * rust: bssl-tls: Do not provide the TlsSession example
+  * rust/bssl-tls: Expose set_tlsext_host_name to support client SNI.
+  * Use scopers in CBB_flush_asn1_set_of
+  * Use the error queue a bit more consistently in CBB functions
+  * Update version for Bazel Central Repository to 0.20260713.0
+  * bssl-sys: fix clippy warnings
+  * bssl-crypto: support ECDSA verification of already-hashed messages.
+  * Implement trust anchor groups on the certificate selection side
+  * Handle serial numbers permissively in OCSP
+  * runner: Switch to CertificatePropertyList for passing properties to the shim
+  * Expose CBS_get_asn1_oid_component
+  * rust: bssl-tls: Unstage the session support
+  * rust: bssl-tls: Fix predicate on `established`
+  * MLKEM benchmark: also add a "private key from seed" benchmark.
+  * ssl: Support ML-KEM by default.
+
+-------------------------------------------------------------------
 Mon Aug 24 05:19:42 UTC 2026 - Fridrich Strba <fstrba@suse.com>
 
 - Update to version 0.20260708:

boringssl.spec Changed

curl-impersonate.patch Changed

@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index bab3d89dd..31be174ce 100644
+index 1ca8962..8d13163 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -442,7 +442,9 @@ if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
@@ -13,7 +13,7 @@
    else()
      list(APPEND C_CXX_WARNINGS -Wall)
    endif()
-@@ -761,8 +763,6 @@ if(FIPS)
+@@ -763,8 +765,6 @@ if(FIPS)
    target_link_libraries(entropy_modulewrapper crypto)
  endif()
  
@@ -22,7 +22,7 @@
  
  if(BUILD_TESTING)
    add_executable(generate_mldsa_certs pki/testdata/verify_unittest/generate_mldsa_certs.cc)
-@@ -864,7 +864,6 @@ endif()
+@@ -876,7 +876,6 @@ endif()
  
  if(INSTALL_ENABLED)
    install(TARGETS crypto ssl EXPORT OpenSSLTargets)
@@ -31,7 +31,7 @@
    install(EXPORT OpenSSLTargets
            FILE OpenSSLTargets.cmake
 diff --git a/crypto/cipher/e_tls.cc b/crypto/cipher/e_tls.cc
-index 0edf61a24..5a8410d34 100644
+index 0edf61a..5a8410d 100644
 --- a/crypto/cipher/e_tls.cc
 +++ b/crypto/cipher/e_tls.cc
 @@ -442,6 +442,22 @@ static int aead_aes_256_cbc_sha1_tls_implicit_iv_init(
@@ -114,7 +114,7 @@
  }
  
 diff --git a/crypto/fipsmodule/ec/p256_test.cc b/crypto/fipsmodule/ec/p256_test.cc
-index a8039c385..3dfbea8fb 100644
+index a8039c3..3dfbea8 100644
 --- a/crypto/fipsmodule/ec/p256_test.cc
 +++ b/crypto/fipsmodule/ec/p256_test.cc
 @@ -21,7 +21,7 @@ BSSL_NAMESPACE_BEGIN
@@ -127,7 +127,7 @@
  #include "../../../third_party/fiat/p256_field.c.inc"
  }
 diff --git a/crypto/rand/windows.cc b/crypto/rand/windows.cc
-index ebd0d4afd..bf9c75e26 100644
+index ebd0d4a..bf9c75e 100644
 --- a/crypto/rand/windows.cc
 +++ b/crypto/rand/windows.cc
 @@ -60,6 +60,9 @@ void bssl::CRYPTO_sysrand(uint8_t *out, size_t requested) {
@@ -183,7 +183,7 @@
  
 diff --git a/export.sh b/export.sh
 new file mode 100755
-index 000000000..1baee7908
+index 0000000..1baee79
 --- /dev/null
 +++ b/export.sh
 @@ -0,0 +1,8 @@
@@ -196,7 +196,7 @@
 +git diff $BASE_COMMIT > boringssl.patch
 +mv boringssl.patch ../curl-impersonate/patches/boringssl.patch
 diff --git a/include/openssl/aead.h b/include/openssl/aead.h
-index 6b8ad575a..bae75c629 100644
+index 6b8ad57..bae75c6 100644
 --- a/include/openssl/aead.h
 +++ b/include/openssl/aead.h
 @@ -579,6 +579,9 @@ OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_tls_implicit_iv(void);
@@ -210,7 +210,7 @@
  OPENSSL_EXPORT const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv(void);
  
 diff --git a/include/openssl/nid.h b/include/openssl/nid.h
-index 6b3bb4506..58980e765 100644
+index 6b3bb45..58980e7 100644
 --- a/include/openssl/nid.h
 +++ b/include/openssl/nid.h
 @@ -5511,6 +5511,11 @@ extern "C" {
@@ -226,10 +226,10 @@
  #if defined(__cplusplus)
  } /* extern C */
 diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
-index 5c6d17ad2..a34cd85a7 100644
+index 3b48c2a..d9c7753 100644
 --- a/include/openssl/ssl.h
 +++ b/include/openssl/ssl.h
-@@ -1732,6 +1732,17 @@ OPENSSL_EXPORT int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx,
+@@ -1734,6 +1734,17 @@ OPENSSL_EXPORT int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx,
  
  // SSL_CTX_set_cipher_list configures the cipher list for `ctx`, evaluating
  // `str` as a cipher string. It returns one on success and zero on failure.
@@ -247,16 +247,16 @@
  //
  // Prefer to use `SSL_CTX_set_strict_cipher_list`. This function tolerates
  // garbage inputs, unless an empty cipher list results.
-@@ -2618,6 +2629,8 @@ OPENSSL_EXPORT size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);
+@@ -2619,6 +2630,8 @@ OPENSSL_EXPORT size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);
+ #define SSL_GROUP_X25519 29
  #define SSL_GROUP_X25519_MLKEM768 0x11ec
- #define SSL_GROUP_X25519_KYBER768_DRAFT00 0x6399
  #define SSL_GROUP_MLKEM1024 0x0202
 +#define SSL_GROUP_FFDHE2048 0x0100
 +#define SSL_GROUP_FFDHE3072 0x0101
  
  // SSL_CTX_set1_group_ids sets the preferred groups for `ctx` to `group_ids`.
  // Each element of `group_ids` should be a unique one of the `SSL_GROUP_*`
-@@ -5536,6 +5549,12 @@ OPENSSL_EXPORT void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled);
+@@ -5569,6 +5582,12 @@ OPENSSL_EXPORT void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled);
  // permute extensions. For now, this is only implemented for the ClientHello.
  OPENSSL_EXPORT void SSL_set_permute_extensions(SSL *ssl, int enabled);
  
@@ -269,7 +269,7 @@
  // SSL_max_seal_overhead returns the maximum overhead, in bytes, of sealing a
  // record with `ssl`.
  OPENSSL_EXPORT size_t SSL_max_seal_overhead(const SSL *ssl);
-@@ -5863,6 +5882,33 @@ OPENSSL_EXPORT int SSL_CTX_set1_sigalgs_list(SSL_CTX *ctx, const char *str);
+@@ -5899,6 +5918,33 @@ OPENSSL_EXPORT int SSL_CTX_set1_sigalgs_list(SSL_CTX *ctx, const char *str);
  // more convenient to codesearch for specific algorithm values.
  OPENSSL_EXPORT int SSL_set1_sigalgs_list(SSL *ssl, const char *str);
  
@@ -303,20 +303,20 @@
  #define SSL_set_app_data(s, arg) (SSL_set_ex_data(s, 0, (char *)(arg)))
  #define SSL_get_app_data(s) (SSL_get_ex_data(s, 0))
  #define SSL_SESSION_set_app_data(s, a) \
-@@ -6238,6 +6284,8 @@ OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
+@@ -6274,6 +6320,8 @@ OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
  #define SSL_CURVE_SECP384R1 SSL_GROUP_SECP384R1
  #define SSL_CURVE_SECP521R1 SSL_GROUP_SECP521R1
  #define SSL_CURVE_X25519 SSL_GROUP_X25519
 +#define SSL_CURVE_FFDHE2048 SSL_GROUP_FFDHE2048
 +#define SSL_CURVE_FFDHE3072 SSL_GROUP_FFDHE3072
- #define SSL_CURVE_X25519_KYBER768_DRAFT00 SSL_GROUP_X25519_KYBER768_DRAFT00
  
  // SSL_get_curve_id calls `SSL_get_group_id`.
+ OPENSSL_EXPORT uint16_t SSL_get_curve_id(const SSL *ssl);
 diff --git a/include/openssl/target.h b/include/openssl/target.h
-index 2372a055d..f8790c3b2 100644
+index 7e5a19a..f3534df 100644
 --- a/include/openssl/target.h
 +++ b/include/openssl/target.h
-@@ -45,6 +45,9 @@
+@@ -51,6 +51,9 @@
  #define OPENSSL_RISCV64
  #elif defined(__riscv) && __SIZEOF_POINTER__ == 4
  #define OPENSSL_32_BIT
@@ -327,7 +327,7 @@
  #define OPENSSL_32_BIT
  #define OPENSSL_PNACL
 diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
-index f4b348481..afb56f59b 100644
+index f4b3484..afb56f5 100644
 --- a/include/openssl/tls1.h
 +++ b/include/openssl/tls1.h
 @@ -48,6 +48,9 @@ extern "C" {
@@ -396,10 +396,10 @@
  #define TLS1_3_RFC_AES_256_GCM_SHA384 "TLS_AES_256_GCM_SHA384"
  #define TLS1_3_RFC_CHACHA20_POLY1305_SHA256 "TLS_CHACHA20_POLY1305_SHA256"
 diff --git a/ssl/extensions.cc b/ssl/extensions.cc
-index 022714a3f..39a45b3e7 100644
+index 90238d9..6304682 100644
 --- a/ssl/extensions.cc
 +++ b/ssl/extensions.cc
-@@ -2383,6 +2383,10 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
+@@ -2414,6 +2414,10 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
    SSLImpl *const ssl = hs->ssl;
    hs->key_shares.clear();
    hs->key_share_bytes.Reset();
@@ -410,7 +410,7 @@
  
    // If offering a PAKE, do not set up key shares. We do not currently support
    // clients offering both PAKE and non-PAKE modes, including resumption.
-@@ -2427,24 +2431,30 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
+@@ -2458,24 +2462,30 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
    }
  
    // Run the default selection if we don't have anything better.
@@ -449,7 +449,7 @@
      }
      selected_key_shares.emplace(default_key_shares);
    }
-@@ -2540,6 +2550,7 @@ bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
+@@ -2571,6 +2581,7 @@ bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
      return false;
    }
  
@@ -457,7 +457,7 @@
    hs->new_session->group_id = group_id;
    hs->key_shares.clear();
    return true;
-@@ -3272,6 +3283,27 @@ static bool ext_quic_transport_params_add_serverhello_legacy(SSL_HANDSHAKE *hs,
+@@ -3303,6 +3314,27 @@ static bool ext_quic_transport_params_add_serverhello_legacy(SSL_HANDSHAKE *hs,
  static bool ext_delegated_credential_add_clienthello(
      const SSL_HANDSHAKE *hs, CBB *out, CBB *out_compressible,
      ssl_client_hello_type_t type) {
@@ -485,7 +485,7 @@
    return true;
  }
  
-@@ -4071,6 +4103,42 @@ static bool ext_server_cert_type_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {

_service Changed

_servicedata Changed

boringssl-0.20260708.tar.xz -> boringssl-0.20260813.tar.xz Changed

Changes of Revision 6