Packman Build Service PMBS

File boringssl.changes of Package boringssl (Revision 86cae2d4ae5785413b02a1e51c613f99)

Currently displaying revision 86cae2d4ae5785413b02a1e51c613f99 , Show latest

-------------------------------------------------------------------
Mon Aug 24 05:19:42 UTC 2026 - Fridrich Strba <fstrba@suse.com>

- Update to version 0.20260708:
  * Install headers into /usr/include/boringssl/openssl/ preserving
    standard-compliant directory nesting rather than flat-installing
    them directly under /usr/include/boringssl and rewriting includes.
  * Rebase patches:
    - 0003-enable-s390x-builds.patch
    - 0006-gcc-disable-werror.patch
    - 0009-soname-sover.patch
  * Remove obsolete patches:
    - 0002-crypto-Fix-aead_test-build-on-aarch64.patch
    - 0004-fix-alignment-for-ppc64le.patch
    - 0005-fix-alignment-for-arm.patch
    - 0007-fix-go-vendor-embed_test_data.patch
    - 0008-fix-go-vendor-err_data_generate.patch
  * Disable Rust DTLS tests for now
  * rust: bssl-tls: Disallow downcasting in-handshake to normal handle
  * Handle CV-qualifiers in __gnu_cxx audit_symbols exclusion
  * Turn SSL into an opaque struct
  * Implement MTC plants-04 non-CA cosignature verification.
  * Implement a vectorized "quad Keccak".
  * Update Android documentation and add -upload-only flag
  * Add ABI tests for Poly1305 Arm assembly
  * Add ABI tests for AES-GCM-SIV assembly
  * Document alignment requirements on AES-GCM-SIV assembly
  * Move the alignment specifier on fe1305x2 to the type
  * rust: bssl-tls: Introduce asynchronous private key delegate
  * tool: correct cast of format argument
  * rust: bssl-tls: Add more RPK related configurations
  * ssl: Do not request or set hints when handshake is torn down
  * Add some tests that X509_NAME_hash does not overcanonicalize
  * Add some basic AI agent skills for BoringSSL development
  * Expand on crypto/obj/README
  * Add missing includes
  * Fix outdated comment in fiat METADATA file
  * Allow a SSL_SESSION to only ever live in one SSL_CTX.
  * Null-check SSL_HANDSHAKE first in SSL_serialize_handshake_hints
  * infra: Add buildbucket.creator binding to shadow buckets
  * rust: bssl-tls: Introduce early callback support
  * infra: Set up basic 'shadow' buckets for ci & try
  * Add GREASE for signature_algorithms
  * Make it more obvious that some ML-KEM vector_decode calls are infallible
  * Import ML-KEM Wycheproof tests
  * Clean up mlkem_test.cc to use a traits object
  * Update Wycheproof test vectors
  * Run Wycheproof ML-DSA signing vectors through verification too
  * Fix typo in test name
  * Fix ML-KEM constant-time validation regression
  * Declassify the result of EC point-on-curve fault checks
  * rust: bssl-tls: Correct the name of the SCT getter function
  * Fix apparent infinite loop in X509NameAttribute::AsRFC2253String
  * SSLBuffer::EnsureCap: ensure `new_cap` can never cause `offset_` overflow.
  * ACVP: update other cases of memcpying into ints.
  * Fix a bad parameter in `PEM_read_bio_inner`'s base64 decoding.
  * ACVP: test SHAKE.
  * ACVP: add extra ML-KEM tests.
  * Remove some old commented out OpenSSL debug code
  * Use scopers for embedded ASN1_STRING and X509_ALGOR
  * Make X509_NAME_ENTRY an opaque type
  * Switch easy fields in X509 to UniquePtr
  * Fold x509_pubkey_{init,cleanup} into the class
  * Fold x509_name_{init,cleanup} into the classs
  * Allow a single SSL to consume and produce handshake hints
  * Remove old Strawberry Perl workaround
  * Implement EC_wpa3_sae_hash_to_curve_p256
  * crypto/x509: Fix handling of pathLenConstraint on self-issued intermediates.
  * fiat: only use asm variants of P256 symbols if they're actually declared.
  * rust: bssl-tls: Properly annotate sections of configuration options
  * Revert "Replace most of P-256 assembly code with C"
  * Finish documenting <openssl/pem.h>
  * Unwind SSL_set_enforce_rsa_key_usage
  * Run pregenerate as part of run_tests
  * clang-format: p256_test.cc
  * perlasm: delimit AESNI `set_encrypt_key_base` function properly
  * Remove PEM_TYPE_* constants
  * Document low-level PEM functions
  * Add TLS_RSA_WITH_AES_256_GCM_SHA384 to ssl_compliance_policy_cnsa1_202603
  * Start expanding and documenting PEM_read and PEM_write functions
  * ANY PRIVATE KEY is not a real PEM type
  * Const-correct PEM_write functions and i2d_SSL_SESSION
  * Normalize in-memory ASN1_BOOLEAN representations on parse
  * rust: bssl-tls: report RPK in custom certificate verifier
  * rust: bssl-tls: convenient certificate verification outcomes
  * rust: bssl-tls: Share some credential configs with builder
  * Unexport IMPLEMENT_PEM_* macros
  * rust: bssl-tls: make DER encoding use slice sanitation
  * Don't depend on tasn_* for ASN1_TYPE functions
  * Fix strict aliasing violations in crypto/asn1 from ASN1_VALUE*
  * Running spelling and grammar checks over comments.
  * Update version for Bazel Central Repository to 0.20260616.0
  * Rewrite tasn_enc and tasn_dec with CBS/CBB
  * Split out a CBS_peek_any_asn1_tag helper from CBS_peek_asn1_tag
  * Remove unnecessary size limit comment
  * Use scopers in IDP and CRDP config parsing
  * Add a test for CRLDP parsing
  * Break out a few more helper functions for supported crypto/asn1 types
  * Support X509 objects with extern ASN1_ITEM helpers
  * Wire up some more types to bssl::UniquePtr
  * Add a test for PolicyInformation parsing
  * Enable .subsections_via_symbols on all assembly files.
  * mac_rel CI/CQ build: enable `-Wl,-dead_strip`.
  * Add platform configuration for "Pythia".
  * Fix comment typo
  * Avoid having a L label at the start of a section on macOS.
  * ssl: return non-const RPK handle
  * Fix license header on p256_internal.h
  * Make the SysV gates for fiat assembly more consistent
  * Disable fiat P-256 assembly on OPENSSL_NANOLIBC
  * OpenSSL Advisory: June 9th, 2026 (BoringSSL Not Affected)
  * delocate: Support a few more aarch64 assembly variants
  * delocate: Treat BORINGSSL_bcm_text_hash as a synthesized symbol
  * xlate scripts: Use .subsections_via_symbols in apple assembly files.
  * Store ML-DSA's s1, s2, and t0 in NTT form
  * Don't decode t0 twice in the testing-only ML-DSA format
  * runner: Unconditionally fill in our vendored ML-DSA public key
  * Make Montgomery reduction clearer in ML-DSA
  * Add EVP_CIPHER_CTX_max_next_update and EVP_CIPHER_CTX_max_final
  * Fix compile-time assertion about sizing of AES-GCM-SIV data.
  * Use the vectorized "double Keccak" for ML-DSA too.
  * Use templates to simplify ML-DSA's scalar_*code functions, making all dispatch compile-time.
  * delete extraneous test data file
  * Update documentation about ASN.1 BIT STRING lengths
  * Implement MTC plants-04 CA cosignature verification.
  * Switch from select to poll in demo command-line tool
  * Add a tool to update bazel dependencies
  * Update bazel dependencies
  * Fix build
  * Touch up v2i_AUTHORITY_KEYID
  * Add some tests to exercise v2i_AUTHORITY_KEYID
  * Clarify that TLS-specific AEADs are not AEADs
  * rust: cargo update
  * Use scopers in certificate policy conf logic
  * Add tests for constructing certificate policies from strings
  * util/ar: Fix integer conversion in bounds check
  * Update dependencies in go.mod
  * runner: Rewrite some ServerKeyExchange serializers with cryptobyte
  * Flip the sign on timezone offset calculation
  * Update GitHub actions/checkout to version 6
  * Reject invalid IV lengths in EVP_CTRL_GCM_SET_IV_INV
  * Include inline functions from BCM in the shared build's hashed region
  * draft-ietf-dnsop-svcb-https was also published
  * draft-ietf-lamps-dilithium-certificates is now RFC 9881
  * Restore the libcrypto C++ runtime dependency, but with a build flag
  * Fix error_depth in the name constraints common name check
  * Add default SSL options to SSL_OP_ALL
  * Unroll the ML-DSA NTT outer loops.
  * In SSL_reset_early_data_reject, clear out unreported bytes written.
  * Update Wycheproof test vectors
  * Replace most of P-256 assembly code with C
  * For AES-GCM-SIV, also require PCLMUL instruction set.
  * Add CMS_LIB to kLibraryNames.
  * Documentation: Change |...| to `...` for code references in comments 9/N
  * Remove the size limits for AES-EAX.
  * Documentation: Change |...| to `...` for code references in comments 15/15
  * Documentation: Change |...| to `...` for code references in comments 14/N
  * Documentation: Change |...| to `...` for code references in comments 12/N
  * Remove unreachable checks in builtin BIO callbacks
  * Convert built-in BIOs to write_ex
  * Switch some BIO_write calls to BIO_write_ex
  * Documentation: Change |...| to `...` for code references in comments 13/N
  * Take another pass at EVP_MD_CTX and EVP_CIPHER_CTX documentation
  * Implement plants-04 landmark relative MTC verification.
  * Implement BIO_write_ex
  * Narrow BIO_read and BIO_write error values
  * Fix BIOTest.SocketConnect on platforms where loopback is synchronous
  * Fix non-blocking connect completion check in BIO.
  * Fix EVP_MD_CTX reuse across EVP_PKEY algorithms
  * Use C++ destructors in by_dir.cc
  * Clean up by_dir's get_cert_by_subject function
  * Documentation: Change |...| to `...` for code references in comments 11/N
  * Documentation: Change |...| to `...` for code references in comments 10/N
  * Documentation: Change |...| to `...` for code references in comments 8/N
  * Documentation: Change |...| to `...` for code references in comments 7/N
  * Documentation: Change |...| to `...` for code references in comments 6/N
  * Documentation: Change |...| to `...` for code references in comments 5/N
  * Documentation: Change |...| to `...` for code references in comments 4/N
  * Documentation: Change |...| to `...` for code references in comments 3/N
  * CI/CQ custom libc++: enable bounds checked containers.
  * CI/CQ custom libc++: enable unspecified sorting order randomization.
  * armv8 assembly: do not branch to global symbols.
  * Rewrite add_cert_dir's directory string parsing
  * Turn SSL_CTX into an opaque struct
  * Test that X509_LOOKUP_hash_dir ignores duplicates
  * Update style guide to change |...| to `...` for code in comments
  * Documentation: Change |...| to `...` for code references in comments 2/N
  * Documentation: Change |...| to `...` for code references in comments 1/N
  * Fix SSL_OP_LEGACY_SERVER_CONNECT with TLS 1.3
  * Add some tests for file and fd BIOs
  * Add the proper limit to PKCS5_PBKDF2_HMAC.
  * Fix limits for AES-GCM-SIV.
  * AES-CTR-HMAC: Apply the 64 GiB limit to open operations too.
  * Release name_list if SSL_set0_client_CAs does nothing
  * Fix OBJ_dup's handling of malloc failures
  * Restore the SSL_OP_LEGACY_SERVER_CONNECT option
  * CBB_cleanup: null out the buffer pointer if it was freed.
  * Fix uninitialized data read by AES-GCM-SIV assembly.
  * EVP_CTRL_GCM_IV_GEN: reject if the IV length is <8.
  * Reject legacy_cookie in DTLS 1.3
  * Switch away from being an entropy-injected FIPS module.
  * Tag new BoringSSL release for Bazel.
  * RC2: fix RC2 heap overflow with _huge_ key lengths.
  * DSA_check_signature: on failure, set *out_valid = 0.
  * add CBS_get_u48
  * Bump BORINGSSL_API_VERSION
  * Fix off-by-one allowing an unauthenticated handshake abort.
  * bio_read_all: bail out on every error.
  * RSA: handle gracefully when a SSL_PRIVATE_KEY_METHOD has NULL methods.
  * X509_VERIFY_PARAM_inherit/_set1: refuse if either params are poisoned.
  * RSA_generate_key_ex: tighten up code a bit.
  * RSA_generate_key_ex: reject invalid values of e.
  * Expand on infra/config/README.md a bit
  * [Server Padding] Don't pad on resumption handshake.
  * build: Do not list .inc as compile unit
  * Revert "CI/CQ: in debug builds, enable lots of libc++ checks."
  * CI/CQ: in debug builds, enable lots of libc++ checks.
  * Minor optimizations to ML-DSA: marking some internal functions inline.
  * Switch STACK_OF(T) back to std::sort from std::stable_sort
  * Use the certificate issuer in CMS/PKCS7 signer IDs
  * rust: bssl-macros: Do not depend on std
  * crypto/evp: Eliminate `operator delete` from EVP_PKEY_CTX destructor
  * Correctly handle max_early_data_size over 2^16
  * Alert on ClientHello with only one of key_share and supported_groups
  * Introduce SSL_get_signature_algorithm_used.
  * TRUST_TOKEN: remove metadata_key.
  * Server Padding Extension
  * Add a document explaining what a "named group" is
  * Add SSL_CTX_set1_available_trust_anchors
  * Fix sectioning in ssl.h
  * Fix typo in benchmark name
  * Fixup some minor issues in HPKE P-256 key derivation
  * Tidy up poly1305 alignment a bit
  * Stop manually encoding various x86 extensions from perlasm
  * Clear r->neg in bn_abs_sub_consttime
  * Fork detection test: align the stack to 16 bytes.
  * Disable fork detection test on qemu.
  * Bump version for Bazel Central Registry
  * Limit PEM data to 1 GiB.
  * Roll windows toolchain
  * Fix presubmit errors in infra/config/main.star
  * Consistently fill in the sign bit in BN_lebin2bn and BN_bin2bn
  * Disable the tests for fork detection on Linux < 4.14.
  * Inherit hostflags verify params even without hosts
  * Clean up bssl::PEM_read_bio_inner.
  * Fork detection: add rfork() and similar support for FreeBSD/OpenBSD.
  * Implement libpki's HexEncode function more straightforwardly
  * Remove internal NumberToDecimalString helper
  * Align libpki's PEM parser with crypto/pem a bit
  * Add some tests to capture libpki's PEMTokenizer behavior
  * Clear the counters for empty or warning records only on actual data.
  * rust: bssl-tls: Raw Public Key credentials
  * Fix integer overflow in CollapseWhitespaceASCII.
  * x509: Use explicit has_value on optionals
  * TRUST_TOKEN_ISSUER: add missing `return 0` when trying to set a too small metadata key.
  * rust: bssl-tls: feature gate the sync_io module
  * rust: bssl-tls: Expose bssl_sys::SSL handle from `TlsConnection`
  * perlasm: Conform to the visibility convention and fix typo
  * ssl: const-correct SSL_CREDENTIAL
  * Implement a vectorized "double Keccak".
  * rust: bssl-tls: Introduce custom certificate verification
  * draft-ietf-tls-tls13-pkcs1-00 is now RFC 9963
  * Fix BIO_set_retry_special
  * Test non-blocking connect in connect BIOs
  * crypto/x509: Tighten URI name constraints parsing and matching
  * Fix return value in x509_print_rsa_pss_params error path
  * rust: bssl-tls: Do not depend on `tracing` yet
  * crypto: Make X509* and EVP_PKEY* const clonable
  * bssl-crypto: Stop gating ML-DSA on a Rust feature flag
  * rust: bssl-tls: Remove TlsConnectionRef
  * rust: bssl-tls: Promote CertificateCache to a full ref-counted type
  * Use placement new to initialize the atomic into the WIPEONFORK page
  * Implement EVP_HPKE_KEY_derive
  * Use HPKE-PQ test vectors from the spec
  * rust: bssl-tls: fix MockSocket behaviour on pending read
  * rust: bssl-x509: rename our panic-catcher
  * x509: Switch from implicit `bool`-conversion to `has_value`
  * Update Wycheproof test vectors
  * Reference-count CRYPTO_BUFFER_POOLs
  * rust: bssl-tls: Sessions for TLS 1.3
  * rust: bssl-tls: Carve out tokio support into its own crate
  * rust: bssl-tls: I/O mocking infrastructure
  * rust: bssl-tls: General functional tests
  * rust: bssl-tls: Formatting and feature gate fix
  * audit_symbols: Allowlist stdext:: weak symbols on Windows
  * Modernize crypto/x509/policy.cc a bit
  * Add helpers to match characters in CBS
  * Various IWYU fixes
  * Check for negative bit indices in ASN1_BIT_STRING_set_bit
  * Hook up X-wing to EVP_KEM
  * Fix the legacy AES-GCM API's IV resizing logic
  * Move some code around in v3_ncons.cc
  * Fix up v2i_NAME_CONSTRAINTS
  * Add tests for nameConstraints' ad-hoc config parser
  * Clear the sorted bit after sk_FOO_set
  * rust: bssl-tls: Add MLDSA into list of signature algorithms
  * Tidy up ownership a bit in X509_get1_email and friends
  * Defer dedup in X509_get1_email and friends to the end
  * Unwind EC_FELEM hooks on EC_METHOD
  * Add an EVP adapter for KEM encap/decap
  * Add sk_FOO_sort_and_dedup
  * Update documentation for ML-KEM
  * pregenerate: Compile public headers entirely as C.
  * Reject trailing data in ClientHello and EncryptedExtensions trust_anchors
  * Test trailing data in OCSP staple parsing
  * Test trailing data for SNI parsing
  * Remove the OPENSSL_NO_ASM gate in OPENSSL_cleanse
  * Add tests for X509_get1_email and friends
  * pregenerate: Collect symbols with -DBORINGSSL_NO_CXX
  * pregenerate: Don't process libpki headers for symbols
  * EVP_PKEY: Treat pss_params as params for RSA-PSS keys
  * Allow no-op EVP_CTRL_AEAD_SET_IVLEN calls to keep the IV set
  * slhdsa: Reorder a BSSL_CHECK with its shift
  * Fix some unreachable code in curve25519_64_adx.h's fiat_addcarryx_u64
  * rust: bssl-tls: Introduce basic session controls on context level
  * rust: bssl-tls: More advanced controls over certificate verification
  * rust: bssl-tls: More advanced control over IO transport
  * rust: bssl-tls: Introduce TLS alerts
  * Don't skip calling the cleanup hook in EVP_PKEY_CTX when the copy hook fails
  * Check for invalid certificate_authorities extensions
  * Remove p224-64.cc.inc
  * pki: Check for unused bits when verifying MTC proofs
  * rust: bssl-tls: Reinstate preshared key tests
  * rust: bssl-x509: Stop reporting partially constructed cert chain
  * rust: bssl-x509: proper serialisation of X.509 certificate serial number
  * Test 0 * P + 0 * G in ec_point_mul_scalar_public
  * Cut down on test-only OPENSSL_EXPORTs
  * rust: bssl-rustls-adapters: Mask the content type and protocol
  * rust: bssl-tls: std and tokio transport integration
  * rust: bssl-tls: Drop Sync on BIO objects
  * rust: bssl-tls: Application facing I/O
  * rust: bssl-tls: Make certificate store more ergonomic
  * Add missing CONSTTIME_SECRET markers to ML-DSA implementation
  * Configure .clangd and .clang-format so that header insertion works
  * Reset IV state in legacy AES-GCM API on EVP_CTRL_AEAD_SET_IVLEN
  * Support ML-DSA in libssl
  * Require internal and external ML-KEM public key structs to match in size
  * rust: bssl-tls: Cap the input length reported by the abstract socket
  * Update documented default scrypt memory limits
  * EVP_PKEY_copy_parameters: Allocate new receiving key if not present
  * Handle short-name-less NIDs in X509_NAME_print_ex
  * Remove SSL_R_PAKE_AND_KEY_SHARE_NOT_ALLOWED
  * EVP_PKEY: null-check EVP_PKEY_ASN1_METHOD before using
  * Fix beeu_mod_inverse_vartime on aarch64
  * More gracefully handle invalid ASN1_STRING objects in ASN1_STRING_print_ex
  * Allow zero-length inputs in SHA256_TransformBlocks
  * Fix ERR_add_error_data call in SSL_add_dir_cert_subjects_to_stack
  * More consistently make the ASN1_TYPE-level type take precedence over the ASN1_STRING one
  * rust: bssl-tls: Take a borrowed credentials
  * rust: bssl-tls: Drop unused functions
  * rust: bssl-tls: Bubble up EOF during shutdown
  * Fix output bounds checking in EVP_AEAD_CTX_seal_scatter
  * Fix return value on impossible error condition
  * pki: Set a default iteration limit of 20
  * Check for PMULL in gcm_sha3_capable
  * Document some historical mistakes in HandshakeHints tagging
  * Check hashes when parsing test-only, semi-expand ML-KEM private keys
  * Update style guide to reflect C++ usage
  * rust: bssl-tls: Cope with upstream type inference regression
  * Split MLKEM's scalar_*code functions into compile-time alternatives by bit size.
  * rust: bssl-tls: Safe abstraction of a partially filled buffer
  * Clarify that the old PSK API is just about TLS 1.2 PSKs
  * rust: bssl-tls: Keep CertificateCache live
  * Remove check_imported_libraries.go script
  * Update reference for X-Wing to a more recent draft
  * Unroll the ML-KEM NTT outer loops.
  * Disable check_imported_libraries check on CI
  * Link to CMVP certificate for 20240805
  * ML-KEM benchmarks: add per-operation microbenchmarks.
  * Add a value barrier to EVP_sha256_final_with_secret_suffix too
  * Add unit tests for EVP_aead_aes_128_cbc_sha256_tls
  * docs/references: Use the newer RFC for ChaCha20-Poly1305
  * Add some missing #includes
  * Remove an unused label and dead code from chacha20_poly1305_armv8.pl
  * Rust: fix a missing import
  * anyExtendeKeyUsage -> anyExtendedKeyUsage
  * Fix typos
  * rust: bssl-macros: Add Apache-2.0 license
  * Clear unused bits in ASN1_STRING_set/set0
  * delocate: Support three-argument .prefalign
  * Add ASN1_BIT_STRING_set1
  * Add ASN1_BIT_STRING_unused_bits and deprecate ASN1_BIT_STRING_num_bytes
  * Remove ASN1_BIT_STRING implicit truncation
  * Explicitly trim strings in ASN1_BIT_STRING_set_bit
  * Correct a comment in serializing a CBS_ASN1_BITSTRING
  * rust: bssl-crypto: fix clippy errors
  * rust: bssl-tls: Give an option to disable session controls
  * rust: bssl-tls: More TLS context protocol controls
  * Drop the irrelevant tests from other CLs
  * rust: bssl-tls: Split TlsMode
  * rust: bssl-tls: Introduce preshared key support
  * rust: bssl-tls: Introduce connection builder
  * Update SSL_CTX_set0_buffer_pool reflecting CRYPTO_BUFFER_POOL changes
  * Run the GeneralNames parser through trailing data tests
  * Fix wrong parser variable in directoryName trailing data check
  * bio->method cannot be null
  * Don't use both bio and impl in the same function
  * Remove some stray OPENSSL_EXPORTS in a .cc file
  * rust: bssl-tls: adopt Linux kernel Rust import style
  * Fix BIO_find_type with BIO chains
  * Minor optimizations to MLKEM: marking some internal functions inline.
  * Remove OPENSSL_EXPORT from some internal libssl functions
  * Update email address for CI failure notifications
  * util/fipstools: allow rsakpg2-[basic|crt] for KTS-IFC
  * Add #includes missing from RPK implementation
  * Add missing headers to documentation generator config
  * Add flags to bssl client and bssl server to test RPKs
  * Fix sectioning in ssl.h
  * Turn SSL_ECH_KEYS into an opaque struct
  * Turn SSL_CREDENTIAL into a namespaced opaque struct
  * Tell GitHub (and other indexing tools) which files are generated code.
  * rust: bssl-tls: Introduce control over certificate stores and chains
  * rust: bssl-tls: Given option to drive handshake until error
  * Raw Public Keys: Process and verify received RPKs
  * rust: bssl-tls: Mark the as_mut_ptr functions as unsafe
  * rust: bssl-tls: Expose bytes behind CRYPTO_BUFFER wrappers
  * Bump version for Bazel Central Registry release.
  * rust: bssl-tls: Check with the right buffer size limit for Rust FFI
  * GitHub Actions: Only run on google/boringssl
  * Raw Public Keys: Store peer cert type and RPK in SSL_SESSION
  * rust: bssl-tls: Fix a typo on the cert verification mode option
  * Set IWYU pragmas for prefix_symbols.h and friends.
  * Add ML-KEM and ML-DSA to EVP_PKEY_from_raw_public_key
  * rust: bssl-x509: Introduce public key type
  * rust: bssl-tls: Change context method access into shared
  * crypto/x509: remove OpenSSL exception for name constraints "@example.com".
  * Add some implementation techniques to references.md
  * runner: Gracefully detect when the handshaker cannot parse flags
  * Update CI deps
  * Update dependencies from BCR
  * runner: Print something when errUnimplemented is rejected
  * Add more test data for OCSP handling
  * Make make_ocsp.py deterministic
  * Bump ocsp_unittest to RSA-2048 from RSA-1024
  * Fix execution_timeout on CQ
  * rust: bssl-x509: Drop unused repr(transparent)
  * Avoid Windows cross-dll constexpr issues in mldsa_test.cc
  * Support ML-DSA certificates in libpki
  * Support ML-DSA in verify_signed_data.cc
  * Raw Public Keys: Select and send RPK as client Certificate
  * Raw Public Keys: Select and send RPK as server Certificate
  * Don't rely on trailing NUL in ASN1_TIME_to_generalizedtime
  * Remove commented-out test code.
  * mldsa_test: Use Wycheproof test vectors more fully
  * mldsa_test: Use a Traits struct instead of lots of template parameters
  * Update Wycheproof test vectors
  * Add new compliance policy profiles for CNSA 1.0 and 2.0
  * OpenSSL Advisory: April 7th, 2026 (BoringSSL Not Affected)
  * convert_wycheproof: Return an error instead of panicking
  * rust: bssl-tls: Export keying materials
  * crypto/x509 nc_email: sync to libpki's logic.
  * Also test that DCs are not negotiated at TLS 1.1
  * Fix pki/testdata/ocsp_unittest/make_ocsp.py for Python 3
  * Fix pki/testdata/ocsp_unittest/annotate_test_data.py for Python 3
  * Raw Public Keys: Configure and advertise available client cert types
  * Raw Public Keys: Determine and send negotiated client_certificate_type
  * Mark ssl.h as exporting ssl3.h and tls1.h
  * draft-ietf-tls-esni is now RFC 9849
  * Define OPENSSL_NO_UI_CONSOLE
  * Switch callers within the library to EVP_PKEY_eq
  * Add EVP_PKEY_eq and EVP_PKEY_parameters_eq
  * Restore X509_check_private_key's error after EVP_PKEY_cmp narrowing
  * Start filling in some functions from OpenSSL 3.x
  * Add definition of OSSL_PARAM
  * Benchmark all three ML-DSA sizes
  * Fix use of empty line in prefix_symbols.h.
  * Work around a GCC false positive warning
  * Update annotate_test_data.py to python3
  * rust: bssl-tls: allow FFI interop with BoringSSL-dependent libraries
  * Tidy up X509StoreGet1IssuerMultipleMatches tests a bit
  * Raw Public Keys: Configure cert types accepted from the server
  * Remove a stray space
  * Use stable sort in OPENSSL_sk_sort to sort STACK_OF(T)
  * Add some missing #includes
  * rust: bssl-tls: Introduce shutdown controls
  * rust: bssl-tls: Introduce I/O model
  * Bump version for BCR to 0.20260327.0
  * rust: bssl-tls: add TLS-specific error codes
  * rust: bssl-tls: Precise control over handshakes
  * rust: bssl-tls: basic bssl-tls framework
  * Symbol renaming: also rename inline functions using `redefine_extname`.
  * Regression test for I7cdf6cbdbd5f07093cdf3c191bfbd5c46a6a6964.
  * Reapply "Reapply "Simplify the symbol prefixing macros.""
  * Don't vote Presubmit-BoringSSL-Verified:-1 on dry run cancellation
  * Partial rollback of I40aed9832f72f6bd2b4b8a7f9d68f60ae0eb1e2c.
  * rust: Fix the lifetime contract for intermediate certs used by verifiers
  * Add new EVP_KEM API
  * CQ: Apply Presubmit-BoringSSL-Verified label when dry run finishes
  * Implement ML-KEM integration with EVP_PKEY_CTX
  * Add a helper to compare two ML-KEM public keys
  * Add accessors for ML-KEM public key part of private key
  * Revert "Reapply "Simplify the symbol prefixing macros.""
  * Reapply "Simplify the symbol prefixing macros."
  * i2d_SSL_SESSION: support operating as allocating i2d function.
  * Fix misspelling in error reason name
  * GitHub: Loosen branch-time.yml check
  * Add a function to copy the public part of an EVP_PKEY
  * rust: Move test data around for incoming crates
  * Array::CopyFrom and InPlaceVector::TryCopyFrom: do not allow in to alias this.
  * Document that BIO flags should usually be left alone.
  * Add RFC 9525 to references
  * Const-correct EVP_PKEY_CTX_set1_signature_context_string
  * Tolerate feof returning arbitrary non-zero values
  * OpenSSL Advisory: March 13th, 2026 (BoringSSL Not Affected)
  * rust: x509 remove deprecated and no-op parameter flags
  * Remove DEFINE_NAMESPACED_STACK_OF from stack_test.cc
  * Remove an easy DEFINE_NAMESPACED_STACK_OF
  * Modernize p_hkdf.cc a bit
  * Use UniquePtr in RSA
  * bssl-x509: don't expose X509CertificateList
  * bssl-x509: API tweaks in certificates.rs
  * Remove unused internal constant
  * bssl-x509: documentation improvements.
  * bssl-x509: various tidy-ups.
  * rust: Pick up std feature by default for x509 and tls crate
  * Remove NewZeroed entirely
  * Add Send and Sync marker traits to X509Certificate
  * Add new Rust crates to build files
  * rust: Fix doc test since last crate renaming
  * rust: Introduce X.509 bindings
  * Remove some more easy NewZeroed calls
  * Remove some dependencies on NewZeroed
  * Wire up ML-DSA keygen to the EVP API
  * Add new APIs to generate EVP_PKEYs
  * Center EVP_PKEY_CTX creation on EVP_PKEY_ALG
  * Place kObjects constants in namespace bssl.
  * runner: Also copy resumeExpectations before running the test
  * Don't allow half-empty EVP_PKEYs to be passed into various APIs
  * Revert "Reduce thread contention for pooled CRYPTO_BUFFERs"
  * Document <openssl/cast.h>
  * rust: Properly dispatch the key types to the right curve after parsing
  * rust: parse keys into the right curve type per DER encoding
  * Document length requirements on low-level DES APIs
  * Check for syntax errors in SANs in X509_check_host
  * Fix typo in comment
  * Add some options to bssl client and bssl server to test PSKs
  * Warn in docs that TLS 1.3 PSKs must be high entropy
  * Revert "Simplify the symbol prefixing macros."
  * Fix prefixed names on MSVC.
  * Simplify the symbol prefixing macros.
  * Implement RFC 9258 as a server
  * Handle an API edge case with PSKs and client certificates
  * Implement RFC 9258 as a client
  * Ignore CMS_PARTIAL in CMS_add1_signer
  * crypto/x509: Fix interaction of DNS exclude constraints with wildcard DNS names.
  * Use UniquePtr in DSAImpl
  * Use UniquePtr in DHImpl
  * Remove redundant DH_num_bits API
  * Reduce thread contention for pooled CRYPTO_BUFFERs
  * Allow CRYPTO_BUFFERs to outlive CRYPTO_BUFFER_POOL
  * C++ CRYPTO_BUFFER internals a bit more
  * Make CRYPTO_MUTEX a C++ type
  * Add a test for bssl::Cleanup
  * Give CRYPTO_EX_DATA_CLASS a constructor
  * Simplify delocate macros slightly
  * More consistently use the public/private struct split in crypto/pool
  * Don't stack-allocate CryptoBuffer for pool lookups
  * rust: Give options to serialise curve names
  * Remove duplicate include
  * GitHub Actions: Tighten up branch-time.yml check
  * ssl: Allow inspection of SSL_CREDENTIAL completion status
  * Add some missing file headers
  * Publish the remaining historical advisories
  * GitHub: Tweak branch-time.yml workflow
  * runner: Add a preSharedKey object
  * GitHub: Create GitHub Actions workflow to check branch time
  * Add a no-op virtual destructor to EvpPkeyCtx
  * audit_symbols: Allow Windows RTTI descriptors to be unprefixed
  * Preprocessor compatibility: update logic for symbol prefixing.
  * Move definition of BORINGSSL_ALWAYS_USE_STATIC_INLINE farther up.
  * Revert "Integrate the new way of C++ symbol prefixing with Bindgen."
  * Remove getrandom_fillin.h
  * Use std::sort in crypto/stack/stack.cc
  * When building a shared ELF library with FIPS, set the section markers hidden.
  * Finish symbol prefixing with delocate (delocate approach).
  * delocate: Pass through .reloc directives associated with pointer field protection
  * CI naming: minor improvements
  * Add GNU linker manual to references
  * Use destructors more in crypto/cms
  * Introduce macro BORINGSSL_ALWAYS_USE_STATIC_INLINE.
  * Reapply "Migrate Bio to RefCounted."
  * Base BIO_free's return value on only the input BIO
  * runner: Don't override the version in the SendBothTickets tests
  * runner: Bundle wire version, protocol version, and isDTLS together
  * runner: Remove version parameter to TLS 1.2 keyAgreement objects
  * runner: Simplify Config.minVersion and Config.maxVersion
  * runner: Check that the server did not resume a session at the wrong version/cipher
  * Rewrite the CipherNotPreferred tests
  * runner: Store a cipherSuite object in sessionState
  * runner: Pass just a hash algorithm, not a cipher suite, into PSK binders
  * Make BORINGSSL_check_test take a pair of spans
  * Split RSA sign and verify KATs
  * Run `go fix`
  * Update filippo.io/edwards25519 to 1.2.0
  * Fix the docs for and test BIO_free's return value
  * rust: Make true links in HPKE doc-string
  * Revert "Migrate Bio to RefCounted."
  * Fix documentation for SSL_set_alps_use_new_codepoint
  * bssl_shim: Make a general SetValueFlag helper in test_config.cc
  * Abstract out the check for whether certificate modes are acceptable
  * Add bssl::Vector::EraseIf
  * Remove unused version parameter to tls13_verify_data
  * Fold tls13_write_psk_binder into the caller
  * runner: Remove a dead condition in dtlsPackRecord
  * runner: Use slices package a bit more
  * Require __NR_getrandom to be either available or polyfilled
  * runner: Make some panics more useful
  * runner: Remove stale recordTypePlaintextHandshake constant
  * Remove BORINGSSL_ALL_PUBLIC_SYMBOLS from pregenerate
  * Remove GitHub pull request template
  * Fix cpu_aarch64_sysreg.cc
  * Split __wasm__ into __wasm32__ and __wasm64__
  * Revert "SSL_CREDENTIAL: Check that configured private key actually has one"
  * rust: simplify the rustls provider crate
  * dtls: bump default maximum protocol version to 1.3
  * rust: Make HPKE layouts more precise and improve documentation
  * rust: HPKE type for TLS interop
  * Const-correct a few more crypto/x509 APIs
  * rust: move rustls adapters to its own crate
  * Const-correct SSL_SESSION_dup
  * Talk about what "CTX" means in API-CONVENTIONS
  * Update documentation on fuzzer mode
  * Remove bad PSK binder assert (debug only)
  * Reland "Add support for ML-DSA `ctx` parameter. Add corresponding tests including a fix of a segfault in setting up context for the VerifyMessage scenario."
  * Migrate DHImpl to RefCounted.
  * Migrate Bio to RefCounted.
  * Bump BCR
  * Migrate X509Impl to RefCounted.
  * Migrate X509Store to RefCounted.
  * Migrate RSAImpl to RefCounted.
  * Migrate ECKey to RefCounted.
  * Fix up DECLARE_OPAQUE_STRUCT docs
  * Migrate ECCustomGroup to RefCounted.
  * Migrate EVP_PKEY to RefCounted.
  * Also implement UpRef() for kAllowRefCountedUniquePtr types.
  * Migrate DSA to RefCounted.
  * Bring RefCounted over from libssl to libcrypto.
  * Activate Windows DLL builds on CI and CQ.
  * Simplify PSK binder calculation
  * evp_test: Fix MaybeReplaceWithCopy for EVP_MD_CTX
  * SSL_CREDENTIAL: Check that configured private key actually has one
  * Use destructors in X509_NAME_CACHE
  * Use destructors more in crypto/bio/connect.cc
  * Add a CBBAsSpan internal helper function
  * Remove header_len parameter to ssl_add_clienthello_tlsext
  * Update other dependencies
  * Update third_party/benchmark to 1.9.5
  * Update Go dependencies
  * runner: syncronize shimListener connChan access
  * Remove exported C++ interfaces from libcrypto that were used only by tests.
  * Android test runner: don't copy libboringssl_gtest.so.
  * Fix DLL build on Windows.
  * rust: clean up other slice casts involved in FFI
  * Add missing test certificates
  * bssl-crypto: use `as_ffi_ptr`.
  * A menagerie of changes to bssl-tls
  * rust: Add `rustls` CryptoProvider adapters
  * util/fipstools: saltLen arg for ACVP RSA/sigGen/pss cmd
  * Add CI builds for Windows DLLs that even run the generated binaries.
  * Revert "Add support for ML-DSA `ctx` parameter. Add corresponding tests"
  * CI: also rename nosse2 to n2.
  * CI: move "fips" from short name into category, and rename "nosse2" to "n2".
  * Partial symbol prefixing support with delocate.
  * CI: build categories and short names in code.
  * Add support for ML-DSA `ctx` parameter. Add corresponding tests including a fix of a segfault in setting up context for the VerifyMessage scenario.
  * CI: give linux32_nosse2_noasm the nosse2 short name.
  * Rebuild categories and short names for the BoringSSL CI console.
  * Remove non-namespaced symbols for ctor/dtor of EC_GROUP.
  * Remove non-namespaced symbols for ctor/dtor of EVP_PKEY.
  * Pregenerate: restructure console output.
  * Pregenerate: remove hack to find clang and to locate the Windows SDK.
  * Remove non-namespaced symbols for ctor/dtor of RSA.
  * Remove non-namespaced symbols for ctor/dtor of X509_STORE.
  * Remove non-namespaced symbols for ctor/dtor of EC_KEY.
  * New BCR release.
  * Delocate: also support `name = value` kind symbol aliasing.
  * Enable most of the prefixed builds that work.
  * Remove non-namespaced symbols for ctor/dtor of DSA.
  * Remove uses of `static inline` in C++.
  * Fix location of NASM flags.
  * Fix Clang-Tidy issues: missing includes.
  * MLDSA, MLKEM, SLHDSA: do not use extern "C" inside anon namespace.
  * Remove non-namespaced symbols for ctor/dtor of DH.
  * Remove non-namespaced symbols for ctor/dtor of BIO.
  * Also move most OPENSSL_free uses to Delete.
  * rust: Add RSA-PSS signature test
  * Remove non-namespaced symbols for ctor/dtor of CMS_ContentInfo and CMS_SignerInfo.
  * Replace malloc/sizeof pattern by New.
  * Add symbol prefixing validation to CMake.
  * Add support for RSA PSS.
  * Fix a broken Go doc comment.
  * util/fipstools: add ACVP KTS-IFC crt support
  * Fix typo in comment
  * Add some missing includes found by clang-tidy.
  * Actually enable symbol prefixing on linux_clang_prefixed_compile.
  * Disable some slow test in unoptimized builds
  * Publish historical advisories from 2021 and 2022
  * Remove most tests' dependency on the dangerous SSL_VERIFY_NONE behavior
  * Only emit .note.gnu.property on ELF targets
  * Add prefixed builds for win_arm64.
  * Fix ios64_prefixed_compile.
  * The prefixing field on the CI system is called `prefixed_symbols`.
  * Remove non-namespaced symbols for ctor/dtor of BN_CTX, CRYPTO_BUFFER, EVP_PKEY_CTX, X509, and X509_NAME.
  * Add CQ builders for symbol prefixing.
  * Fix some trailing whitespace in extension printer
  * Prefixing: do not use relative includes with nasm.
  * Add helpers to query whether an EVP_PKEY has a public/private key
  * AES-GCM: optimize ARMv8 kernel and add EOR3 support
  * Add DLL builds for Windows to CI and CQ.
  * Publish historical advisories from 2023
  * Convert .arch into .arch_extension on Apple arm64 targets
  * Integrate the new way of C++ symbol prefixing with Bindgen.
  * Integrate the new way of asm symbol prefixing with CMake.
  * Publish historical advisories from 2024 and 2025
  * Fix an OK but odd-looking use of ASN1_TYPE
  * OpenSSL Advisory: January 27th, 2026 (BoringSSL Not Affected)
  * Remove outdated comment about updating Chromium sandbox definition
  * sha512-armv8: Correct the comment-only suffixes on sha2 instructions
  * sha512-armv8: Burn in the results of most instruction rewrites
  * sha512-armv8: Pull the .16b suffixes out of the variables
  * Also improve test coverage for the crlDistributionPoints config machinery
  * Update Mechanism: Manual
  * Stop manually encoding AES-NI instructions in aesni-x86.pl
  * Fix strncmp usage in v3_crld.cc to use strcmp
  * Improve issuingDistributionPoint config file coverage
  * Integrate the new way of C++ symbol prefixing with CMake.
  * Add ML-DSA support to X.509
  * util/fipstools: ACVP RSA keyFormat=crt keyGen
  * Add a SECURITY.md pointing to the Chromium process
  * Add a regression test for an OpenSSL SPARC bug
  * rust: add tests and example to pkcs8.rs
  * rust: Unifying PKCS #8 private key parsing
  * rust: Do not check P-Hash output buffer length
  * Update ECDSA comments and logic for FIPS 186-5
  * Use secp224k1 instead of secp160r1 to test a custom curve edge case
  * Add a couple more references
  * Start a references document
  * Add a reference for Arm CPU features in docs
  * Allow DTLSv1_set_initial_timeout_duration to be called mid-handshake
  * Add log_id() getter to MTCAnchor class
  * PRESUBMIT.py: Pass -clang flag to pregenerate
  * Fix asm symbol prefixing includes:
  * pregenerate: refactor Tasks to better support skipping.
  * Remove BSAES code entirely if BSAES is not compiled in.
  * Ignore OPENSSL_STATIC_ARMCAP on non-Arm platforms
  * Modernize the Arm cpuinfo parser a bit
  * Run `buildifier` to format BUILD.bazel
  * infra: Regenerate LUCI config files
  * runner: Stop handle interrupts reentrantly in DTLS tests
  * Fix some minor prefixing misses on Linux.
  * Fix namespaces bssl::entropy and bssl::acvp.
  * Let bindgen rename link names
  * Remove ia32cap_P references from the perlasm code.
  * Namespace crypto/internal.h's internal symbols.
  * Make pregenerate output files `gen/boringssl_prefix_symbols_internal_*.inc`.
  * Make pregenerate output a file `gen/boringssl_prefix_symbols_c.inc`.
  * pregenerate: fix deadlock when filtering out a dependent task.
  * Detect Arm SHA-512 instructions on Windows when available
  * Make keys clone-able
  * Add TLS 1.2 P-hash function binding
  * perlasm scripts: work better if the command interpreter is cmd.exe.
  * Pregenerate: emit all assembly function names
  * extract_identifiers_clang_json: factor out Clang AST logic.
  * Namespace crypto/fipsmodule/sha's internal symbols.
  * Remove paths.cmake as it is no longer in use.
  * runner: Fix -private-key-delay-ms flag
  * runner: Spanify parts of packeted_bio.cc
  * runner: Tidy up initializing a PacketedBio
  * runner: Make AdvanceClock(0) work and test stopping the timeout early
  * Fix race condition in TLS 1.3 InvalidChannelIDSignature test
  * Unseal EC group method in Rust binding
  * Namespace crypto/x509's internal symbols.
  * Revert "Revert "Namespace crypto/trust_token's internal symbols.""
  * Mark Prk as Send + Sync
  * Add HMAC on SHA-384 for TLS 1.3 support
  * Narrow EVP_PKEY_cmp and EVP_PKEY_cmp_parameters return values
  * Fix typo in setting up CMAKE_CXX_FLAGS
  * Use proper label type in TLS1.2 P-hash function
  * Pregenerate: add a concept of tasks that can be waited upon.
  * Deflake DTLS12-SendExtraFinished-Reordered
  * The null parameter should be equal to itself
  * Stop reaching into TRUST_TOKEN_CLIENT internals in the benchmark
  * Move most DTLS 1.3 TODOs to child bugs
  * Test that DTLS 1.2 rejects renegotiation
  * bssl-sys: Remove unsupported_inline_wrappers
  * Raise the maximum RSA key size back to 16384
  * Also check OPENSSL_RSA_MAX_MODULUS_BITS in RSA keygen
  * Rust: Move TLS1.2 PRF into public interface
  * Spanify a couple helper functions
  * Namespace crypto/asn1's internal symbols.
  * Namespace crypto/fipsmodule/bcm_interface.h's internal symbols.
  * Namespace crypto/fipsmodule/bn's internal symbols.
  * Namespace crypto/fipsmodule/aes's internal symbols.
  * Namespace crypto/fipsmodule/ec's internal symbols.
  * Namespace crypto/fipsmodule/service_indicator's internal symbols.
  * Namespace crypto/bytestring's internal symbols.
  * Namespace crypto/bcm_support.h's internal symbols.
  * Namespace crypto/evp's internal symbols.
  * Namespace crypto/fipsmodule/rsa's internal symbols.
  * Namespace crypto/fipsmodule/dh's internal symbols.
  * Namespace crypto/fipsmodule/keccak's internal symbols.
  * Namespace crypto/fipsmodule/rand's internal symbols.
  * Namespace crypto/fipsmodule/ecdsa's internal symbols.
  * Namespace crypto/cipher's internal symbols.
  * Namespace crypto/ec's internal symbols.
  * Namespace crypto/dsa's internal symbols.
  * Namespace crypto/fipsmodule/tls's internal symbols.
  * Namespace crypto/conf's internal symbols.
  * Revert "Revert "Namespace crypto/pkcs7's internal symbols.""
  * bssl-crypto: Add support for serializing and deserializing compressed points
  * Fix build with -Wheader-hygiene
  * Revert "Namespace crypto/pkcs7's internal symbols."
  * Namespace crypto/pkcs7's internal symbols.
  * Namespace crypto/fipsmodule/slhdsa's internal symbols.
  * Namespace crypto/pkcs8's internal symbols.
  * Symbol prefixing: also include symbols that don't have C linkage.
  * bssl-crypto: fix typo in error string
  * bssl-crypto: run cargo fmt
  * Remove internal STACK_OF(X509V3_EXT_METHOD) symbols
  * Clean up no-op cipher aliases for legacy SHA-2 CBC ciphers
  * Add support for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  * Namespace all lhash internal symbols.
  * Namespace crypto/kyber's internal symbols.
  * Namespace crypto/hrss's internal symbols.
  * Namespace decrepit/cast's internal symbols.
  * Namespace crypto/pem's internal symbols.
  * Namespace crypto/chacha's internal symbols.
  * Namespace crypto/curve25519's internal symbols.
  * Namespace crypto/des's internal symbols.
  * Stop using sqrt(2) in RSA key generation
  * Update RSA-related citations from FIPS 186-4 to FIPS 186-5
  * Use consistent RSA keygen and import limits
  * Revert "Namespace crypto/trust_token's internal symbols."
  * Remove the last remnants of iovec in their experimental state
  * Namespace crypto/trust_token's internal symbols.
  * infra: Move Android FIPS builders to RelWithAsserts
  * infra: Extend timeout for Android devices on CI/CQ
  * Change `(void)` function prototypes to `()` in C++ code.
  * list_unintended_exported_symbols.sh: work fine within jj.
  * modulewrappers: use the correct bssl namespace.
  * list_unintended_exported_symbols: export public symbols list.
  * When listing unexported symbols, disable asm for now.
  * Include <openssl/rand.h> when defining RAND_maybe_seed.
  * runner: Copy testCase objects before mutating them in-place
  * crypto/x509/v3_cpols.cc: do not forward declare ASN.1 items.
  * Restore mac_arm64_bazel
  * delocate: Use adrp/add in loadAarch64Address
  * Compute the FIPS module hash after evaluating relocations
  * inject_hash: Support finding the marker symbols in .symtab or .dynsym
  * Test clearing out-of-bounds bits with ASN1_BIT_STRING_set_bit
  * inject_hash: Convert more Go empty string checks
  * delocate: Add adrp BORINGSSL_bcm_text_start to our tests
  * inject_hash: Switch a bytes.Index to bytes.Contains
  * Add API to configure server's NamedGroups with equal preference
  * inject_hash: Add an option to hash a different object from what we rewrite
  * Fix namespacing of err_save_state_st.
  * Identifier extractor: fix linkage of constants.
  * Add a script to list unintended symbols in libcrypto.
  * Move `crypto/rsa/internal.h` into the `bssl` namespace.
  * Move `crypto/bio/internal.h` into the `bssl` namespace.
  * Move `crypto/err/internal.h` into the `bssl` namespace.
  * Symbol extractor: handle more cases.
  * Rework test Merkle Tree machinery
  * Empty subtrees are invalid
  * Convert Go string-empty checks to `!= ""`.
  * Spanify internal EVP_AEAD APIs.
  * EVP_AEAD AES-GCM: bring back missing buffer size check.
  * Make libssl no longer export the lhash symbols for SSL_SESSION.
  * Bump BORINGSSL_API_VERSION
  * Remove the odd __cplusplus gating of libpki's include guards
  * Add `RAND_maybe_reseed`
  * Implement TrustStoreCollection::GetTrustedMTCIssuerOf
  * Fix some include spelling in libpki
  * EVP_AEAD: rip out internal remnants of the legacy open/seal API.
  * Add missing include
  * [WIP] Support verifying signatureless MTCs.
  * Put a test function that's extern "C" explicitly not in the anonymous namespace.
  * Use CRYPTO_store_u32_be in tls_cbc.cc
  * Add a missing error check in bench/aead.cc
  * Pass a slightly smaller upper bound to TLS CBC MAC calculation
  * EVP_AEAD: make the iovec APIs mandatory for all AEADs.
  * Add some more value barriers to Lucky 13 mitigation
  * EVP_AEAD: implement sealv/openv for AES-GCM-SIV.
  * Fix up constant-time annotations for TLS CBC ciphers
  * EVP_AEAD: implement sealv/openv for the TLS ciphers.
  * EVP_AEAD: implement sealv/openv for ChaCha20-Poly1305.
  * EVP_AEAD: implement sealv/openv for AES-CCM.
  * EVP_AEAD: implement sealv/openv for AES-EAX.
  * EVP_AEAD: add a helper to process iovecs on a per-block basis.
  * Move `err_data.cc` symbols into the `bssl` namespace.
  * Link to CMVP certificate for 20240407
  * Fix a missing incldue in `aead.cc.inc`.
  * Revert "Revert the initial seal/openv implementations"
  * AEAD tests: fix accidental bit overlap.
  * Deduplicate some code to compute test vector paths
  * Skip iovec tests for NIST CAVP vectors
  * Split sealv, openv, and openv_detached into separate tests
  * Recreate the TestIOVecs on every test call
  * When testing AEADs, don't split both the AAD and the plaintext.
  * Revert the initial seal/openv implementations
  * EVP_AEAD: implement sealv/openv for AES-GCM.
  * EVP_AEAD: implement sealv/openv for AES-CTR-HMAC-SHA256.
  * EVP_AEAD: declare CRYPTO_IOVEC based APIs to support zero copy I/O.
  * infra: Remove seemingly unused win_toolchain cache
  * Check in .bazelversion and MODULE.bazel.lock in util/bazel-example
  * infra: Prefix all of BoringSSL's caches
  * Make third_party/benchmark's configure script less noisy
  * Format *.bzl, *.bazel files using buildifier
  * Add a try builder to run boringssl presubmits
  * Fix minor benchmark issues:
  * Retire RSA blinding support
  * Benchmark long-lived vs newly-imported RSA keys for both sign and verify
  * Use google/benchmark for performance tracking
  * Make the benchmark timeout a floating point, not integer, flag.
  * Add a utility to extract identifiers from public headers.
  * Remove non-CBC codepaths from e_tls.cc
  * Don't condition BORINGSSL_self_test on !_MSC_VER
  * Inject the custom libc++ globally
  * Don't build third-party deps with our warnings
  * infra: Bump android-21 to android-24 on CI
  * infra: Disable mac_arm64_bazel builder again
  * Simply warnings config slightly
  * Stop setting -fmsc-version in our build
  * infra: Retain CMake toolchain defaults in win*_small builders
  * Another attempt to implementation_deps, preserving transitivity
  * Unbreak build on Visual Studio.
  * runner: Revise chain certificate passed to shim
  * runner: Test change cipher spec tests with no CCS message
  * Add a libssl user to util/bazel-example
  * Revert "util/util.bzl: use implementation_deps to hide internal header"
  * Don't detect pre-C++11 in <openssl/base.h>
  * Retire the STLport workaround
  * Keep STL includes inside extern "C++"
  * Add missing include for bssl::Span.
  * Fix copy-paste error in comment
  * runner: Use slices.Clip instead of x[:len(x):len(x)]
  * Fix BoringSSL public includes for Tree-sitter parsability.
  * Fix PRESUBMIT.py
  * bssl speed: better and more consistent pattern matching in `-filter`.
  * Revert "[infra] Temporarily disable mac_arm64_bazel from CQ"
  * [infra] Temporarily disable mac_arm64_bazel from CQ
  * Fix a bunch of lint errors.
  * util/util.bzl: use implementation_deps to hide internal header
  * Bump version for BCR release.
  * `util/analyze_bssl_speed.go`: also parse lines for "1 byte".
  * Link to ACVP results for 20251031.
  * `bssl speed`: include all AEAD implementations and directions.
  * Rephrase the bssl-crypto warning a bit
  * Deprecate no-op startup/shutdown ERR functions
  * Fix up `PEM_do_header` to use `size_t`
  * Add AES-CTR-HMAC-SHA256 to `bssl speed`.
  * Add a quick tool to analyze `bssl speed` output.
  * `bssl speed`: add a flag `-cputime`.
  * Add a -request-trust-anchors flag to bssl client
  * Fix typo in style guide
  * Add a helper function to split strings in tool/
  * Clang-format tool/client.cc and tool/server.cc arguments list
  * Add helpers for working with relative OIDs.
  * ML-DSA signature test from seed
  * Standardize the comments on the closing brace of extern "C".
  * bssl::Span::subspan: split into two overloads.
  * Make `bssl::Span::subspan` behave like `std::span::subspan`.
  * Remove some non-span methods of der::Input
  * Upgrade linux bots from ubuntu 22.04 to 24.04
  * Support handle poisoning in EVP_Decrypt ops too.
  * Spanify EVP_Cipher update and final methods.
  * Implement pure version of SLH-DSA-SHAKE-256f
  * Update NDK on CI to r29
  * Use _t and _v versions of type traits
  * Add some documentation for updating ACVP tests.
  * Move all internal calls to the new API with size checking.
  * Unwind wait_for_entropy diagnostic function in getrandom code
  * Add function to evaluate MT inclusion proof
  * Add presubmit check for bzl/bazel file formatting using `buildifier`
  * acvptool: ML-DSA external mu, internal sig. interface
  * Update all the Bazel things
  * Remove workaround for Bazel C/C++ issue
  * Add BCR presubmit testing for Bazel 8.x and rolling
  * Add ML-DSA-87 variants to Rust wrappers
  * EVP_Cipher: fix comments about required buffer sizes.
  * Bump version for BCR
  * acvptool: Fix error reporting if dk or c are empty
  * Fix ACVP tests
  * Add missing #include
  * Add API functions for OpenSSL ciphers with sized output.
  * Format *.bzl, *.bazel files using buildifier
  * Update acvptool for recent server-side changes.
  * Remove ro.boringcrypto.hwrand toggle on Android
  * Fix util/bazel-example under Bazel 9.0.0rc1
  * Implement Merkle Tree operations.
  * Don't abort in a non-FIPS build.
  * Sync flags from `CMakeLists.txt` to `util/util.bzl`.
  * Update PRNG docs to reflect recent changes
  * Fix constant_time_conditional_memxor on some input lengths
  * Fix potential constant time issue
  * Add an external mu variant of ML-DSA verification
  * Bump android-18 to android-21 on CI
  * Update Android NDK to r27d on CI
  * Spellcheck the codebase
  * Ensuse self tests run for ML-DSA prehash signing
  * Run ML-DSA Wycheproof verify tests through EVP too
  * Set `-fno-strict-aliasing` when building with bazel.
  * runner: Don't parse zero-length OCSP responses in tests
  * Add basic integration with ML-DSA and EVP
  * EVP_DecryptUpdate: fix comment about required buffer size.
  * Update Wycheproof test vectors
  * Include the public key in ML-DSA private keys
  * Add constants in nid.h for encoded OIDs
  * Make the EVP_PKEY_ASN1_METHOD tables static
  * Fold p_${alg}_asn1.cc into p_${alg}.cc
  * Fix error handling for invalid TLS 1.3 status_request extensions
  * Fix some more NULLs by hand
  * Also modernize-use-nullptr the BCM fragments
  * IWYU fixes
  * Add an /* up to */ comment to all subspan calls that may truncate.
  * Make constant-sized calls to Span::first/last/subspan compile-time sized.
  * Initialize last_sample_ to fix maybe-uninitialized warning.
  * Also fix nullptr in internal header files
  * Apply modernize-use-nullptr fixes in all .cc files
  * Add some more notes to CONTRIBUTING.md
  * Take another pass at CONTRIBUTING.md
  * Remove some easy OPENSSL_EXPORTs
  * Add an assert for a correct buffer size.
  * Elide storage of bssl::Span size if known at compile time.
  * Uprev the CIPD version of infra/3pp/tools/perl/windows-amd64
  * Add a PRESUBMIT.py script to check pregenerated files
  * Fix a bug when BN_mod_sqrt is called on very annoying primes
  * Remove NID_MLKEM1024 alias
  * Document how BN_mod_sqrt handles the `in` parameter
  * Test bssl::InplaceVector with a move-only type
  * Rust wrappers for external mu variant of ML-DSA
  * Document that ASN1_STRING_set_by_NID enforces the bounds on the string
  * Also accept incorrectly-encoded X509 v1 version fields again
  * Prevent false positive in constant time checks
  * Allow empty extension lists in X.509
  * Use a less verbose pattern to heap-allocate temporaries in ML-DSA
  * Const-correct the internal/external pointer casts
  * Don't have separate BCM and ML-KEM and ML-DSA types
  * Unwind <openssl/bcm_public.h>
  * Add SSWU_NU encode-to-curve functions from RFC 9380.
  * Unify the HPKE implementation for ML-KEM.
  * Update Go on CI
  * Bump the macOS versions on our CI to macOS 12 or 13
  * Deprecate SSL_CIPHER_get_name
  * Remove some unused constants
  * Order TLS1_TXT_* and TLS1_CK_* in the same order
  * Remove TLS1_TXT_* constants for unimplemented cipher suites
  * Add OIDs and NIDs for ML-DSA-{44,65,87} and ML-KEM-{768,1024}
  * Restore TLS 1.3 TLS1_CK_* constants
  * Remove TLS1_CK_* constants for unimplemented cipher suites
  * Add additional check, as contract of function
  * Bump BORINGSSL_API_VERSION to 37
  * Add API for caller to hint server's preferred key shares
  * Update CI dependencies
  * Update Bazel deps and bump version for BCR
  * Add newer HPKE configuration to Rust wrappers.
  * Rework ML-DSA modular operations
  * Add ML-KEM-1024 option for HPKE.
  * entropy_modulewrapper: set batch mode.
  * Add some missing includes
  * Define X-Wing constants as expressions.
  * Add ML-KEM-768 option for HPKE.
  * Put the legacy cipher constants back in tls1.h and ssl3.h
  * Introduce cipher constants without the leading 0x03
  * Update status of FIPS 20250728
  * Tolerate nullptr in i2d_X509_NAME
  * Add some missing includes
  * Fix and test other self-assignment cases in crypto/x509
  * Const-correct all i2d_*_bio functions
  * Add ACVP modulewrapper for the jitter entropy SHA-384 implementation.
  * Document that HMAC_Final can have a nullptr `out_len`.
  * Add a missing note about the hashes in ssl_compliance_policy_fips_202205 docs
  * Fix bugs found by clangsa
  * Make setting an X509_NAME to itself work
  * Make the ASN1_TYPE-level type take precedence over the ASN1_STRING one
  * Use CRYPTO_addc_w in bn_from_montgomery_in_place
  * Use a simpler process to compute n0
  * Forbid setting EC public key to point at infinity
  * Remove stale comment
  * Upgrade the opportunistic CRYPTO_sysrand calls to normal ones
  * Remove some stale ifdefs from urandom.cc
  * Reject explicit default X.509 versions and empty extension lists
  * Bump the minimum CMake version to 3.22
  * Add API for configuring client key shares
  * draft-ietf-lamps-x509-policy-graph is now RFC 9618
  * Test a few more unusual TBS certificates
  * Const-correct a bunch more of <openssl/x509.h>
  * Unwind ASN1_ANY_AS_STRING
  * Embed X509_NAME into X509
  * Don't create partial X509 and X509_CRL objects to search the X509_STORE
  * Const-correct X509_NAME and test thread-safety
  * Rewrite the X509_NAME parser
  * Parameterize the tag in IMPLEMENT_EXTERN_ASN1_SIMPLE
  * Test a few more cases of null STACK_OF(T)
  * Make more of atomic<T> available to libcrypto
  * Test that X509_NAME_add_entry will not allow invalid entries to be added
  * Make make_unusual_tbs.go test data idempotent
  * Add EVP_pkey_rsa_pss_sha384 and EVP_pkey_rsa_pss_sha512
  * Store the PSS parameters in the RSA object
  * Don't include every field in every EVP_PKEY_ALG
  * Allow SSL_HANDSHAKE::key_shares to vary in size
  * Always populate supported_group_list
  * Require configured groups for key exchange to be unique
  * Various IWYU fixes
  * [gtest] Clean up single-arg `testing::Invoke()`s
  * Remove stale static asserts about atomics
  * Add X509_parse_with_algorithms
  * Make X509_verify X509_sign_ctx work with EVP_PKEY_RSA_PSS
  * Rewrite X509's parser with CBS/CBB
  * Rename X509_CINF::signature to X509_CINF::tbs_sig_alg
  * Rewrite X509_PUBKEY's parsers with CBS/CBB
  * Parse X509's signature algorithm with the CBS/CBB functions
  * Parse X509_ALGOR without depending on the templates
  * Make ASN1_EXTERN_FUNCS's parse callback CBS-based
  * Remove the tag parameter to IMPLEMENT_EXTERN_ASN1
  * Add X509_ALGOR_copy
  * Write some templated functions for the d2i/i2d convention
  * Make CBS/CBB-versions of crypto/asn1 types
  * Avoid one malloc indirection in X509
  * Test the implicit cleanup feature of X509_sign_ctx, etc.
  * Add a benchmark for parsing with d2i_X509
  * Systematically test that parsers catch trailing data
  * Test verifying signatures over "unusual" TBSCertificates
  * Use std::string_view in x509_test.cc
  * Clear the extension list when removing the last extension
  * Refresh basic constraints test certificates
  * Document ASN1_item_sign's order of operations a bit
  * Add a few more TODOs for functions that should be const but aren't
  * Use the new SPKI API in d2i_RSA_PUBKEY and friends
  * Unexport a few more ASN1_ITEMs
  * Make some test data of unknown ASN.1 types slightly less invalid
  * Test ASN1_TYPE parsing more extensively
  * Add EVP_PKEY_ALG-based raw public/private key importers
  * Use EVP_PKEY_bits in SimplePathBuilderDelegate
  * Update citations from RFC 3447 to RFC 8017
  * Replace OPENSSL_ARRAY_SIZE with std::size
  * Const-correct the kPrintMethods table
  * Add SHA-256-only support for EVP_PKEY_RSA_PSS
  * Write a CBS-based RSA-PSS parameter parser
  * Switch libssl to the new SPKI parsing APIs
  * Switch libpki to the new SPKI-parsing APIs
  * bssl-crypto: Switch to new SPKI/PKCS8 parsing APIs
  * Introduce EVP_PKEY_ALG
  * Add internal EC parsing functions that take lists of allowed groups
  * Test lookup and creation by RSA parameters in evp_test
  * bump fiat-crypto (remove redundant return statements)
  * Make FileTest work with std::string_view
  * Test key import in EVPTest a bit more extensively
  * infra/config: Remove luci.recipes.use_python3 experiment
  * Add an ERR_equals function
  * Add utility for dumping raw jitter samples.
  * Use inline asm to read cntvct_el0 to accommodate GCC
  * bssl-crypto: Fix Ed25519 SPKI parser to check key types
  * Add a jitter entropy source.
  * Set an EVP_PKEY's algorithm and data together
  * Make some more half-empty EVP_PKEY states impossible
  * Limit EVP_PKEY_set_type to EVP_PKEY_X25519
  * Add a test that arbitrary curves can be wrapped in EVP_PKEY
  * Stop tracking an ENGINE in EVP_PKEY_CTX
  * Rename EVP_PKEY_METHOD to EVP_PKEY_CTX_METHOD
  * Pull the EC_GROUP_new_by_curve_name up into EVP_PKEY_CTX_set_ec_paramgen_curve_nid
  * Split evp_tests.txt into separate files
  * Add a test for SPKI and PKCS8 parsing with unknown algorithms
  * Fix markdown syntax in BUILDING.md
  * Test async BIO_flush and fix a corner case
  * Rename EVP_R_EXPECTING_AN_EC_KEY_KEY to match OpenSSL
  * Document the generators for all the MODP groups
  * Remove an old, impractical TODO
  * Say a bit more in docs about how to use EVP_PKEY_CTX
  * Bump version for BCR
  * Run through more code in PKCS#8 and SPKI parsers
  * Fix typo in comment
  * runner: Remove need for an AllCurves value
  * Remove redundant copy of EVP_PKEY type
  * Remove EVP_PKEY_print_* support for DSA
  * Don't support parameterless DSA keys in SPKIs
  * Add a couple more no-op compatibility functions
  * More consistently reset EVP_PKEYs in free_it
  * Unexport the Kyber implementation
  * Deprecate EVP_PKEY_set_type
  * Fix reference to public key in evp.h docs
  * pki: add PEMDecode and PEMDecodeSingle
  * Switch to using a derivation function in CTR-DRBG.
  * pki: allow span<string_view> for allowed types in PEMTokenizer
  * Style guide: mention placement of & for reference types
  * Update releasing docs slightly
  * Implement MLKEM1024 for TLS
  * delocate: support 4-bit tweak immediates for AArch64.
  * Add a discussion about callbacks to API Conventions
  * Don't run CTR-DRBG in Kyber tests.
  * Link to ACVP results for 20250728.
  * Bump Bazel deps and version for BCR
  * Expand BCM abbreviation in the FIPS.md documentation
  * Add IWYU export in nid.h file generated by objects.go
  * Fix documentation typo
  * Revert Rust config for 32-bit Linux CI/CQ bots
  * Run Rust recipe steps on Mac CI/CQ builders and 32-bit Linux
  * Run Rust recipe steps on "win64_rel" builder
  * Make Windows Rust try builder use a Release build
  * Add a default-off win64_rust try builder for testing
  * Run Rust recipe steps on "linux" builder
  * Fix FIPS version number comment.
  * Add AES-CCM to test_fips.cc.
  * Add AES-KW(P) to test_fips.cc
  * Remove DES from test_fips.cc
  * Fix typo in header comments
  * Make checkout_rust in util/bot/DEPS also run hooks for clang
  * Work around a Rust problem tripped by working around a Rust problem, which in turn was tripped by working around a Rust problem
  * rust: Gate new lint on Rust version
  * Revert "Add a try builder to run boringssl presubmits"
  * Add a try builder to run boringssl presubmits
  * Add PRESUBMIT.py for infra/config
  * Specify ACL for CQ new patchset runs
  * rust: add includable CQ builder for testing
  * Add a comment about ct and gcc builtins
  * Pull in Rust toolchain via util/bot/DEPS
  * Add a Rust workspace
  * Add X-Wing KEM option for HPKE.
  * rust: Suppress unnecessary_transmutes warnings in bssl-sys
  * Update .gitignore to check in Cargo.lock files
  * [clang-tidy] First stab at making clang-tidy bot work
  * Fix some tabs in build.json
  * Fix some more IWYU issues
  * Keep SHA-1 in crypto.h
  * Fix Rust build
  * Add sha2.h
  * Add ML-DSA-44
  * Rename bn_mul_mont to bn_mul_mont_words
  * Remove Lw and Hw macros from BN internals
  * bssl-crypto: Test that we don't accidentally accept RSA-PSS keys
  * Test that libssl rejects id-RSASSA-PSS certificates
  * runner: write a new test certificate library
  * Drop the RSA, DSA, and DH DoS limits to 8,192 bits
  * Make BN_MONT_CTX opaque
  * Shave 8 bytes off BN_MONT_CTX in 64-bit
  * Inline a small single-use variable
  * Supress the run_tests target when we're a subdirectory
  * Don't look for libunwind when BUILD_TESTING is off
  * Update tools and prep for 0.20250701.0
  * More clearly suggest passing NULL for EC and EC_KEY APIs
  * Add EVP_PKEY_get_ec_curve_nid and EVP_PKEY_get_ec_point_conv_form
  * Remove the SHA-1 default for PSS with EVP_PKEY
  * Document the default use of SHA-1 with OAEP
  * Change the RSA-PSS salt length default to RSA_PSS_SALTLEN_DIGEST
  * Import Bedrock code for P-256 point double, add
  * Use CRYPTO_load_* and CRYPTO_store_* in ML-DSA
  * runner: Remove Leaf field from Credential
  * Test more EVP_PKEY_CTX_copy cases
  * Use C++ destructors for RSA_PKEY_CTX
  * Remove tbuf from RSA_PKEY_CTX
  * Avoid making assumptions about RSA_PSS_* constants
  * use intrinsics for adc/sbb on MSVC
  * fix p256_64_msvc.h
  * Don't suppress CMAKE_(C,CXX)_FLAGS in MSVC builds
  * Document versions undergoing CAVP testing
  * runner: silence some confusing errors when tests fail
  * Test server_name acknowledgement
  * Document that EVP_PKEY_CTX_set_rsa_keygen_pubexp takes ownership
  * Add constants for special PSS salt length values
  * bedrock2 platform, tests, 64-bit p256_coord_sub
  * Pack SHA-512 and BLAKE2b a little more tightly.
  * Make EVP_MD_CTX hold the hash state inline.
  * Add a stub implementation of SSL_CTX_get_security_level
  * Fix link to FedRAMP policy.
  * Add link to 2023 FIPS certificate
  * Add a couple more missing includes
  * Don't pass `parent` or `ad` to CRYPTO_EX_free
  * Address some minor things from the MLDSA mu support.
  * Add an external mu variant of the ML-DSA API (65 and 87 variants).
  * Make CRYPTO_EX_DATA opaque
  * Move CRYPTO_refcount_t into internal headers
  * Remove unused bputs hook
  * Make BIO and BIO_METHOD opaque
  * Update defaults for PKCS12_create
  * Note a couple of typoed struct names that we'll leave alone.
  * xwing: tweaks and cleanups.
  * Update references to RFC 2898
  * add a test for -fno-strict-aliasing
  * Fix some more IWYU issues
  * Replace OPENSSL_ia32cap env test with a unit test
  * Update googletest
  * Remove empty messages in static_assert
  * Remove P-224 from TLS
  * Fix OPENSSL_ia32cap parsing.
  * Remove the need for scratch space when squaring
  * Fix some theoretical missing earlyclobber markers in inline assembly
  * Introduce an opaque in-memory object to manage xwing private keys.
  * Implement the X-Wing KEM as drafted in https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem-07.
  * Suppress -Wcast-qual in STACK_OF implementation
  * Unexport <openssl/service_indicator.h>
  * Add missing newlines and section headers to sha.h
  * Update most deps and bump version
  * Increase default salt length from 8 to 16 bytes in PKCS#8 and PKCS#12
  * Tidy up some comments and #defines around salt lengths
  * Expose ML-DSA-87 in the public headers.
  * Fix EVP verify documentation.
  * Send only usable trust anchor IDs in EncryptedExtensions
  * Add CBB_discard
  * Document that "add1" is like "set1"
  * Remove ext_dat.h
  * Remove v3_ocsp_accresp
  * Don't stack-allocate incomplete X509/X509_CRL objects
  * Also add BIO_meth_get_write and BIO_meth_get_read
  * Reapply "Remove Karatsuba multiplication in BIGNUM"
  * Test non-NEON codepaths with a OPENSSL_NO_STATIC_NEON_FOR_TESTING
  * Simplify the implementation of OPENSSL_STATIC_ARMCAP
  * Use C++ destructors a little more
  * Clean up ssl_file.cc
  * Remove some dead code from SSL_CTX_use_certificate_chain_file
  * Write some tests for ssl_file.cc
  * Remove --no_auth from download_from_google_storage hooks
  * Rewrite crypto_md32_* with templates instead of function pointers
  * Convert EC_KEY_derive_from_secret to scopers
  * Add various missing includes
  * delocate: Support more aarch64 load instructions with :lo12:
  * Remove STACK_OF(CRYPTO_EX_DATA_FUNCS)
  * Remove STACK_OF(BIGNUM) from BN_CTX
  * Don't define N in hrss/internal.h
  * Add front(), back(), and pop_back() to internal containers
  * Move most of libssl's C++ utilities to libcrypto
  * Disable CFI in FIPS module
  * Expose P1363-based ECDSA sign/verify functions
  * Use max_cert_list for TLSv1.3 NewSessionTicket
  * Replace sscanf() with strtoull() in OPENSSL_ia32cap parser
  * Fix urandom_test includes so it is not a no-op
  * Make bssl_shim and fuzzer BIOs use the public APIs
  * Make LHASH a completely internal type
  * Put BIO_clear_flags with the other flags functions
  * Add BIO_meth_set_callback_ctrl
  * Implement BIO_meth_get_*
  * Align bio_info_cb with upstream OpenSSL
  * Fix BIO_eof for BIO pairs
  * Tidy up the BIO_ctrl implementations
  * Add missing asserts to SSL_get_(min|max)_proto_version
  * Add CBB_add_asn1_element convenience function
  * Some more IWYU fixes
  * Fix rust build breakge, unable to find cmake artifacts
  * Avoid redefining constants introduced in glibc 2.41.
  * IWYU in cms_test.cc
  * Fix v2i_AUTHORITY_INFO_ACCESS
  * Remove dependencies in the library on der::Input(std::string_view)
  * Switch a bit more of libcrypto to scopers
  * [acvptool] Fetch and upload arbitrary algortihms
  * Flatten a few more inner CMake files
  * Honor the BUILD_TESTING option
  * Stop copying targets into subdirectory in the CMake build
  * Update ACVP tests in light of 99bd1df99b
  * I have been laid off from Google.
  * Convert more things to scopers
  * Pull BN_mod_pow2 and BN_nnmod_pow2 out of BCM
  * Pull BN_sqrt out of BCM
  * Convert most of BN to scopers
  * Bump version for BCR
  * Tidy TLS 1.2 cipher selection.
  * Put all VS runtime dirs in PATH
  * Update tools, etc
  * Switch to the CIPD Windows SDK package
  * Implement functions to generate CMS external signatures
  * Move most PKCS #7 test data to files
  * Add CBB_flush_asn1_set_of calls to pkcs7_add_signed_data
  * Add EVP_marshal_digest_algorithm_no_params
  * Add some CBB-based functions for crypto/x509 and crypto/asn1 types
  * Shave 8 bytes off EVP_AEAD_CTX
  * Fix backward check in crl_crldp_check
  * Remove OPENSSL_CAN_USE_ATTR_FALLTHROUGH
  * Remove EVP_MD_FLAG_PKEY_DIGEST
  * Remove MAC truncation from FIPS interface.
  * Remove B_ASN1_UNKNOWN
  * Support ANY attribute values in X509_NAME
  * Remove ASN1_PRINTABLE
  * Support OCTET STRING attribute values in X509_NAME
  * Optimize computation of H^2 from H^1 in AES-GCM
  * Do not include asn1_mac.h from rust
  * Default to no target prefix when generating Android build files.
  * Mention the license notice for new files in CONTRIBUTING
  * Spell Apache 2.0 correctly in fiat/README.chromium
  * Use Montgomery reduction in DSA verify
  * Use std::sort instead of qsort in libssl
  * Fix comment on bn_div_rem_words and use MSVC instrinsic
  * Change to use ALPS new codepoint as default
  * upprev boringssl/util/bot/perl-win32 dep
  * Make Golint happy
  * Revert "Remove Karatsuba multiplication in BIGNUM"
  * Add `hpke::Kem::get_public_key`
  * Add support for C2PA validation modes
  * Add a missing ifdef to CRYPTO_set_fuzzer_mode call
  * Fix comment for SSL_get_write_sequence.
  * Pull SLH-DSA test out of BORINGSSL_self_check()
  * Add APIs to access DTLS record layer state
  * draft-kwiatkowski-tls-ecdhe-mlkem-01 is now draft-ietf-tls-ecdhe-mlkem-00
  * Remove MSVC C4702 suppressions in code
  * Remove MSVC warning suppressions around Windows system headers
  * Fix fuzzer build on Windows
  * Refresh fuzzer corpus
  * Simplfy fuzzer build
  * Make bcm use internal AES functions
  * Don't override the clock in BORINGSSL_UNSAFE_DETERMINISTIC_MODE
  * Fix the link order of various dependencies
  * Fix some duplicate #defines
  * Rewrite header guards
  * Remove the avx10_256 entry from BORINGSSL_function_hit
  * Clean up aes-gcm-avx512-x86_64.pl to assume 512-bit vectors
  * Rename avx10 and avx10_512 to avx512
  * delocate: Preserve AVX-512 tokens when rewriting labels
  * Tolerate RCS-MLS custom critical extensions
  * Accept only digital signature key usage for RCS-MLS
  * correct old license on aes.cc
  * Move gcm_gmult_vpclmulqdq_avx10 and add comment
  * Move polyval into asegcmsiv
  * Start extracting AES
  * Make MODULE.bazel and BUILD.bazel buildifier-clean
  * Mark some transitive includes as IWYU export.
  * Remove bn_div_words from bn-586.pl
  * Remove Karatsuba multiplication in BIGNUM
  * Decrease BN_MONTGOMERY_MAX_WORDS to 16384 bits
  * Convert a few more things to scopers
  * bn: Change return type of `bn_mul_mont_*` internals to `void`.
  * Correct an incorrect license that was committed recently
  * [fuzz] Replace is_pod
  * Handle nullptr arguments to FIPS key generation functions
  * Move some exponentation functions out of the FIPS module
  * Remove optimized even modulus mod-exp implementation
  * Warn in SSL_export_keying_material API docs that lengths must match
  * Add mode for MLS client auth, with EKU checking
  * Const-correct SSL_export_keying_material
  * Remove unused "endbranch" x86-64 encoder
  * Add AES-EAX EVP_AEAD cipher
  * Stop manually encoding a bunch of x86-64 instructions
  * Migrate remaining uses of io/ioutil
  * go mod tidy
  * acvptool: Disable GCS support by default
  * Update deps and tag a version for BCR
  * Replace an old README.chromium file with a plain README.md
  * Implement draft-ietf-tls-cross-sni-resumption
  * Fix missing vzeroupper in poly_Rq_mul()
  * Use vmovdqa to save/restore xmm registers in AES-GCM code on Windows
  * Fix missing vzeroupper in gcm_ghash_vpclmulqdq_avx2() for len=16
  * aes-gcm-avx10-x86_64.pl: use strict mode and sync with avx2 code
  * Update PQ ACVP to reflect NIST's breaking changes.
  * aes-gcm-avx10-x86_64.pl: fold _ghash_mul_step into _ghash_mul
  * runner: Test export keying material across all protocols
  * runner: Restore error output in the "unexpected failure" case
  * Split runner.go into a bunch of different files
  * Fix CBS_get_any_asn1 to match the documentation.
  * runner: add one-to-many error mapping for canonical error checking in BoGo tests
  * delocate: Recognize msl as an ARMConstantTweak
  * Fix a pair of words that swapped were in ssl.h documentation
  * Add a pregenerated sources.mk
  * Gate CLMUL AES-GCM on SSSE3
  * Stop checking the FXSR bit
  * Use scopers in crypto/fipsmodule/ec
  * Add local targets to .set directives in delocate
  * Add Trust Anchors extension
  * Use FIPS functions in modulewrapper where possible.
  * Restore FIPS version check.
  * Add SLH-DSA self tests
  * Compress the CA extension
  * Add ML-DSA self tests.
  * Add ML-KEM self-tests.
  * delocate: remove the need to demangle local variables
  * Add IWYU pragma to obj_mac.h.
  * Retitle the certificate authorities section in ssl.h
  * Iterate on SSL_CREDENTIAL_set_must_match_issuer a bit
  * runner: Simplify certificate_authorities testing
  * Accept either | or ` in doc.go
  * Remove SSL_VERIFY_PEER_IF_NO_OBC
  * Remove OPENSSL_ia32cap_P and OPENSSL_armcap handling in delocate
  * Add some newlines between distinct setup steps
  * Add --gcs option for uploading test results from GCS
  * Update googletest
  * Add from/to SubjectPublicKeyInfo conversion to ed25519.
  * Clarify bssl-sys build instructions.
  * Support PBES2 schemes in PKCS12_create
  * Fix legacy_version in DTLS 1.3 HelloRetryRequest
  * Remove dependencies between bssl_shim and ssl/internal.h
  * Add a way to prefix Android targets names
  * Shave an easy 16 bytes off SSL_SESSION
  * Avoid running the X.509 auto-chaining logic twice in TLS clients
  * Remove now unnecessary <openssl/arm_arch.h> includes from assembly
  * Revert "runner: Switch back to filippo.io/mlkem768 for now"
  * runner: Switch back to filippo.io/mlkem768 for now
  * runner: Include the name of the message we failed to parse
  * runnner: Switch to Go's crypto/ecdh module
  * Switch to Go standard library functions where available
  * Fix include spelling in spake2plus.cc
  * Revert "Speed up sha512 on x86" and update comments
  * Add ".git" hint to Go module name
  * Bump version for BCR
  * Clarify that sigalg configuration does not impact TLS 1.0/1.1
  * Update dependencies
  * Remove ocsp_revocation_status.h and ocsp_verify_result.h
  * Fix up ClientHello parser errors
  * Add SSL_parse_client_hello
  * use public header instead of internal for ocsp
  * Make CheckOCSP public api
  * Remove SSL_set_check_client_certificate_type and SSL_set_check_ecdsa_curve
  * HPKE DHKEM-P256 BoringSSL Rust
  * FIPS.md: update wording to align with FRR7.
  * FIPS.md: add build instructions for the update stream.
  * util/fipstools: KDA OneStepNoCounter mode support
  * util/fipstools: generalize hkdf KDA subprocess
  * Add a missing word to documentation on the upstream stream
  * Add a section on the latest FedRAMP policy to FIPS.md.
  * Add CBS APIs for fetching an implicitly tagged int64/uint64 fields.
  * Delete some unnecessary implicit conversions in pkcs12_test.cc
  * Remove now unnecessary ia32cap_P customizations
  * Restore the __SHA__ compile-time check for Intel SHA Extensions
  * Clean up license-related scripts
  * Switch the license to Apache 2.0, matching OpenSSL upstream
  * Add a tool to switch the license to Apache 2.0, matching OpenSSL
  * Move copyright lines to the top of the file
  * Remove other references to additional licenses
  * License: change any non-boilerplate comment referring to "OpenSSL license"
  * Rename chacha20_poly1305_*_nohw to chacha20_poly1305_*_sse41
  * Implement SPAKE2+ and its integration in TLS 1.3
  * Collapse the modes directory into aes
  * util/fipstools: cSHAKE ACVP algorithm support
  * Fix link to Mozilla wiki in comment
  * Add missing error with credential/issuer matching
  * runner: Only require a curve match in TLS 1.3 when doing key shares
  * Test that we reject Certificate or CertificateRequest in resumption
  * runner: implement SecondHelloRetryRequest more straightforwardly
  * runner: Make -expect-selected-credential's default more convenient
  * Use std::vector<uint8_t> to store base64-decode byte arrays
  * Document EVP_BytesToKey a bit better
  * Bump API version to 34
  * infra: Use main branch exclusively
  * util/fipstools: basic support for KTS-IFC
  * Reword the SSL_export_keying_material docs slightly
  * Update references in the repo to use the main branch
  * infra: Support both master and main branches
  * Sync presubmit.yml with what landed in BCR
  * Include the extension in the error in ssl_parse_extensions
  * Remove ASN1_UTCTIME_cmp_time_t
  * util/fipstools: update RSA sigGen cmd args docs
  * util/fipstools: support feedback KDF w/ empty IVs
  * Add a function for Conscrypt to use
  * Fix unwrap comment for CBB_init_fixed
  * Document and test PEM_X509_INFO_read_bio's odd decryption behavior
  * Test some obscure modes of EVP sign/verify with RSA keys
  * Remove some dead code in bssl_shim
  * clang-format bssl_shim.cc
  * Rename foo_extra to foo
  * Add explicit prefetching to the new AES-GCM code
  * Add SPAKE2+.
  * Add ability to upload a directory of vector test results.
  * Bump MODULE.bazel for another snapshot
  * Unfork Chromium's Clang update script
  * Remove embed_test_data.go
  * Mark fallible container operations as `nodiscard`
  * Start using bssl::UniquePtr in libcrypto
  * Move RSA_blinding_on out of BCM
  * Switch some tests to std::string_view
  * Initialize iqmp during keygen directly
  * Remove a redundant call to freeze_private_key
  * Add tests for TIME functions that accept offsets
  * Use more span patterns for strings vs bytes
  * Remove calls to now unnecessary MakeSpan/MakeConstSpan
  * Remove now unused size hooks from ECDSA_METHOD and RSA_METHOD
  * Remove some RSA_is_opaque and EC_KEY_is_opaque special cases
  * Use std::string_view for label strings
  * Update CMAKE_CXX_STANDARD in generate_build_files.py
  * Revert "Stop playing with time strings with strlcat"
  * util/fipstools: document AES-gcm-randnonce cmds
  * util/fipstools: add SSH KDF ACVP support
  * Add something to the error queue when Proc-Type version is wrong
  * Gate Rust support for ML-{KEM,DSA} on a crate feature.
  * Stop playing with time strings with strlcat
  * Revert "Always try and enable the new_uninit feature."
  * replace some more allocate + strlcat with asprintf
  * Remove out directories in pki test data
  * replace manual alloction math and srlcats with asprintf
  * use asprintf instead of magic manual allocation
  * Always try and enable the new_uninit feature.
  * Add another missing file header
  * Add some missing file headers
  * Align a few license headers with OpenSSL's "copyright consolidation"
  * Remove uses of `strcpy`, `strcat`, and `sprintf`, and handle NULL in some functions.
  * Import "Remove some code for a contributor that we cannot find" from upstream OpenSSL
  * Import "Undo commit d420ac2" from upstream OpenSSL
  * Disable the "AVX10/256" AES-GCM functions for now
  * Add VAES + AVX2 optimized AES-GCM
  * util/fipstools: adjust KDF-counter command docs
  * util/fipstools: support more digests w/ hmacDRBG
  * Don't mutate the buffer in PEM_get_EVP_CIPHER_INFO
  * Import "Remove some code" from upstream OpenSSL
  * Unexport a couple internal PEM functions from pem.h
  * Move implicit OPENSSL_STATIC_ARMCAP definition to target.h
  * Clean up "copyright consolidation" tools
  * Import "Cleanup some copyright stuff" from upstream OpenSSL
  * Import upstream changes to copyright lines
  * Fix objects.go generator to reflect new header
  * Apply OpenSSL's "copyright consolidation" changes
  * Add a tool to summarize and compare copyright lines
  * Update copyright.pl to sync copyright lines from OpenSSL
  * Add a copy of OpenSSL's copyright.pl script
  * Update diff_asm.go
  * SLH-DSA: add support for SHA-256 prehashing.
  * SLH-DSA: add ACVP support
  * Disable MSVC's C4702 warning
  * Don't impose Werror on users of BoringSSL
  * Update Go deps
  * Fix a theoretical overflow in BIO_printf
  * SLH-DSA: move into the FIPS module.
  * Also run Kyber through constant-time validation
  * Add a few more anonymous namespaces around struts
  * Add SSL[_CTX]_get_compliance_policy
  * Remove uses of OPENSSL_INLINE and OPENSSL_UNUSED except for public headers
  * Make ec/make_tables.go run cleanly again
  * Don't check for __has_include
  * Use std::optional in one place in bssl_shim
  * Replace OPENSSL_FALLTHROUGH with [[fallthrough]]
  * Fix data buffer size in GCMTest.ABI
  * Require C++17
  * Put structs in anonymous namespaces to avoid ODR worries.
  * ML-KEM: remove private key parsing from public interfaces.
  * ML-KEM: add ACVP support.
  * Avoid reduce_once in scalar_centered_binomial_distribution_eta_2_with_prf
  * Run ML-KEM and ML-DSA through constant-time validation
  * Add Alder Lake to SDE tests
  * util/fipstools: fix HKDFExtract/HKDFExpandLabel cmd docs
  * Move fips_counter_evp_aes_*_gcm into GCM internals
  * Remove alignment requirement on ghash-ssse3
  * Move AES_KEY into GCM128_KEY, GCM128_KEY out of GCM128_CONTEXT
  * Always provide a ctr32_encrypt_blocks function
  * Move ML-KEM into the FIPS module
  * ML-DSA: drop parsing private keys from the public API.
  * Slightly simplify SSLBuffer
  * delocate: support floating point literals in AArch64 asm.
  * ML-DSA ACVP
  * Add ML-DSA-87 in the FIPS module.
  * Move ML-DSA and Keccak into the FIPS module.
  * utils/fipstools: add DetECDSA ACVP support
  * Fix include
  * Start maintaining an AUTHORS file
  * Manually reflow some comments in file headers
  * Work around issue with GCC 8.5 and earlier
  * Ensure that AVX512 is not used on macOS
  * Add missing $ to immediate in aes-gcm-avx10-x86_64.pl
  * Add VAES and VPCLMULQDQ accelerated AES-GCM
  * Refresh fuzzer corpus
  * Support ECH with DTLS 1.3
  * Remove extra va_end in err_add_error_vdata
  * Fix pointer arithmetic in ASN1_item_ex_free
  * Bump the MODULE.bazel version again
  * Use BAZEL_CURRENT_REPOSITORY to pick up test data files
  * Cover DTLS 1.3 in the TLS fuzzers
  * Implement the downgrade protection signal in DTLS 1.3
  * Switch to the actual DTLS 1.3 codepoint
  * Correctly re-ACK client Finished in DTLS 1.3
  * Resolve a couple DTLS 1.3 TODOs in tests
  * Run record padding tests in DTLS 1.3 as well
  * spx: remove
  * Don't report ChangeCipherSpec through the message callback in QUIC
  * Run TLS 1.3 per-message tests in DTLS
  * Move 0-RTT-related DTLS 1.3 TODOs to a child bug
  * Support sending KeyUpdate in DTLS 1.3
  * scrypt: increase default memory limit.
  * Make `bcm_infallible` and `bcm_status` enum classes
  * Fix DTLS cross-version resumption tests
  * Print the OS error when bssl_shim hits SSL_ERROR_SYSCALL
  * Rework how DTLS ACKs and retransmits are flushed
  * Call BIO_flush when sending a DTLS 1.3 ACK
  * Add SSL_is_quic API
  * Test that post-handshake flows do not implicitly ACK Finished
  * Check for message sequence overflow in DTLS
  * Remove centos7_java11_devtoolset10 from BCR presubmits
  * Implement receiving KeyUpdates in DTLS 1.3
  * Run clang-format on ssl.h
  * Remove Dilithium in favor of ML-DSA
  * Bump MODULE.bazel to 0.20241203.0
  * Implement CRYPTO_addc_* and CRYPTO_subc_* in C++ more straightforwardly
  * Mark some local symbols as static
  * Remove redundant GCM tests
  * Add EVP_MD_CTX_get0_md
  * Update tools and add a .bazelversion
  * Speed up sha512 on x86
  * crypto: switch to C++
  * Remove the old SSL_R_APPLICATION_DATA_INSTEAD_OF_HANDSHAKE logic
  * Don't access the read_buffer directly in read_v2_client_hello
  * Don't refer to key_update_requested responses as ACKs
  * Test ACKing and reassembly of post-handshake messages
  * runner: Move some test bugs into the callback
  * Test that the DTLS 1.3 server retransmits NewSessionTicket correctly.
  * Fix OPENSSL_NO_ASM build for ARM
  * Document expected operations on libssl custom BIOs
  * Gate -fno-rtti on BORINGSSL_ALLOW_CXX_RUNTIME
  * Tweak comment in thread.h slightly
  * Build with -Wextra-semi in Clang
  * runner: Move receivedFlightRecords tracking up a layer
  * Remove outdated DTLS 1.3 test suppression
  * runner: Remove unused skipPacket method
  * Remove stale DTLS 1.3 TODO
  * Schedule ACKs when we receive a partial flight
  * Introduce a DTLSTimer abstraction
  * Check for QUIC in SSL_process_quic_post_handshake
  * runner: Remove outdated FragmentClientVersion logic
  * Test DTLSv1_get_timeout behavior
  * runner: Add a helper to read and downcast a message
  * runner: Rearrange 0-RTT code in server slightly
  * Return OPENSSL_timeval by value
  * Call the message callback for DTLS 1.3 ACKs
  * Better track final vs early versions
  * Update the default retransmit timeout for DTLS
  * runner: Remove unused SendHalfRTTData option
  * Send one ACK immediately after the handshake in DTLS 1.3 servers
  * clang-format all of ssl
  * Include <memory> in mldsa.cc
  * Support skipping tickets in both ticket callbacks
  * Exercise SSL_TICKET_AEAD_METHOD in runner
  * Disable sdallocx detection by default
  * Correctly retransmit the final flight in DTLS 1.3
  * Track SSL session types a bit better on the client
  * Don't pack fragments as efficiently for plaintext records
  * Reject NewSessionTicket messages with empty tickets in TLS 1.3
  * Remove stray semicolon
  * Update the timer API for DTLS 1.3
  * runner: ACK flights in DTLS 1.3 by default
  * Handle implicit ACKs in DTLS 1.3
  * Use DTLS 1.3 ACKs to avoid retransmitting ACKed fragments
  * SLH-DSA: support SHA-384 as the prehash function instead.
  * Test that DTLS retransmit can react to MTU changes
  * Redo DTLS retransmit tests
  * runner: don't assume BlockMod implements SetIV
  * Remove redundant tests.
  * Fix up a DTLS 1.3 comment.
  * Run some DTLS tests across all versions
  * Stage new DTLS 1.3 read epochs until the first record comes in
  * acvptool: unbreak tests.
  * Add support for prehashed SLH-DSA.
  * Pack DTLS fragments into records when possible
  * runner: Retain past epochs
  * runner: Move epoch state into a separate structure
  * Don't attempt to send early data in DTLS 1.3.
  * Don't issue early data capable tickets in DTLS 1.3.
  * runner: Remove explicit seq parameter to encrypt and decrypt
  * runner: Remove unnecessary config parameter to hc.changeCipherSpec
  * runner: Remove redundant check for (D)TLS 1.3 in test code
  * Adding Debug derivation for RSA PublicKey
  * runner: Flush DTLS fragments on key change in our 1.3 test stack
  * Remove now redundant check for extra DTLS messages in epoch 1
  * fix indexing_slicing and unwrap warnings
  * Update Cargo.toml after the cfg rename
  * Copy bindings to OUT_DIR in bssl-sys build.rs
  * mldsa: abstract over the matrix size.
  * utils/fipstools: add SHAKE-128/256 ACVP support
  * Spanify the DTLS packet assembly logic a bit
  * Implement a fixed-width ring buffer for DTLS 1.3
  * Amortize invariant maintenance in DTLSMessageBitmap
  * add some details to releaseing.md
  * Store an Array in hm_fragment
  * Use DTLSRecordNumber in DTLSWriteEpoch
  * mldsa: convert to C++
  * Return the record number out of the DTLS record layer
  * Update BCR to 20241024.0
  * Resolve DTLS 1.3 TODOs in ssl_test.cc.
  * Never reconstruct 1.3 record numbers above 2^48-1
  * enable honor_gerrit_linked_accounts for boingssl
  * Allow bssl_shim to be ptraced by anyone if waiting for a debugger
  * Rename DTLS 1.3 TODOs.
  * Pull the DTLS reassembly bitmap into its own abstraction
  * Have modulewrapper print more of its build environment.
  * Standardize on Init vs InitForOverwrite for value vs default initialization
  * Move tests for libssl's internal utilities into a separate file
  * Process (and ignore) DTLS 1.3 ACK messages.
  * util/fipstools: add EDDSA ACVP support
  * Support resumption in DTLS 1.3.
  * Move RecordNumberEncrypter to DTLS-specific state
  * Store DTLS epoch state separately
  * Copy the infra/config branch into an infra/config subdirectory
  * Improve handling of DTLS 1.3 post-handshake messages.
  * Don't use OPENSSL_ARRAY_SIZE with an InplaceVector
  * utils/fipstools: add PBKDF ACVP support
  * utils/fipstools: fix ACVP test data comments
  * util/fipstools: SHA2-512-224 ACVP.md updates
  * Suppress cast function type warnings where needed for bio
  * Add SSL_set0_CA_names to configure the CA extension
  * Choose matching credentials if we have ca_names
  * Fix transcript hash for DTLS 1.3.
  * Add the CA extension to client hello
  * Add ssl_has_CA_names and ssl_add_CA_names
  * Change around some "client CA" things
  * Add ChainContainsIssuer to SSL_CREDENTIAL
  * Drop the transcript buffer before hashing ClientHello whenever possible
  * runner: Use some new Go conveniences
  * Use InplaceVector for the various handshake derivations
  * rust: add SLH-DSA support.
  * Fix a typo in scrypt docs
  * util/fipstools: SHA2-512-224 ACVP primitives
  * Switch outgoing_messages to InplaceVector
  * Add a bssl::InplaceVector to libssl
  * Bounds-check bssl::Array and bssl::Vector
  * Make bssl::Vector not require a default constructor
  * Use the STL helpers for managing uninitialized buffers in bssl::Array
  * Bump the minimum MSVC version to 2022
  * Move `alignas` to start of declaration.
  * Rename GrowableArray to Vector
  * Simplify SSLAEADContext::Create slightly
  * Rename default credential to legacy credential
  * Use the same EVP_AEADs for TLS and DTLS
  * Remove redudant version information from SSLAEADContext
  * Indirect stderr through a function
  * Note that the tag won't mirror to GitHub immediately
  * Fix the endianness of DTLS 1.3 ChaCha20 record number encryption
  * Bump module version and Bazel dependencies
  * rust: add wrappings for ML-KEM and ML-DSA.
  * Use illegal_parameter instead of decode_error for invalid key shares
  * Avoid an allocation when deriving the DTLS record number key
  * Do not implement SSL_get_traffic_secrets for QUIC and DTLS
  * go mod tidy
  * rust: minor changes resulting from safety review.
  * rust: make bssl-sys `no_std`.
  * Check for 0-RTT vs final version mismatches earlier
  * Remove redundant have_version bit
  * Add a test for a subtle corner of 0-RTT and version tracking
  * Move ssl->version to ssl->s3->version
  * Add test for how SSL_version interacts with SSL_clear and the initial state
  * Rearrange 0-RTT key schedule setup slightly
  * Check for HelloRetryRequest in the ServerHello state
  * Rework the Bazel workaround's relationship with linkstatic
  * Work around a workaround of a workaround of a Bazel bug
  * Extract SHA384/SHA512/SHA512_256 from bcm
  * Test SSL_get_ivs across all versions and TLS/DTLS
  * [DTLS 1.3] Use HelloRetryRequest in place of HelloVerifyRequest.
  * runner: Slightly simplify sequence number management
  * runner: Remove block pool
  * runner: Fix up how hpke and kyber get their test data
  * hex-search-modify: add tool used in FIPS validations.
  * break-kat.go should have a copyright header.
  * Add some more no-op OPENSSL_INIT_* options for compatibility
  * Store state for each DTLS epoch.
  * Add some compatibility symbols
  * DTLS 1.3 doesn't use EndOfEarlyData
  * slhdsa: fix some ClangTidy warnings.
  * slhdsa: clang-format
  * Update deny-toml to match new version format
  * Write custom tooling for publishing to BCR
  * Sync presubmit.yml from BCR
  * Add templates for Publish to BCR
  * Prepare to tag 0.20240913.0 as the first periodic snapshot
  * Extract SHA224/256 from bcm
  * Fix delocate with the aarch64 NO_ASM build
  * Add SLH-DSA-SHA2-128s from FIPS 205.
  * Don't define `OPENSSL_cpuid_setup` in NO_ASM builds.
  * Bump the minimum CMake version to 3.16
  * Extract SHA1 from bcm
  * Switch to rules_license
  * Update bzlmod dependencies
  * break-kat: update to run all tests directly.
  * Don't enable asm if OPENSSL_NO_ASM is set.
  * nist-pkits: update README.chromium metadata
  * Remove the bcm md5 assembler files.
  * Extract MD5 from bcm
  * Revamp test coverage for invalid key shares
  * Leave some more breadcrumbs in docs for error-handling
  * Extract md4 from bcm
  * Rename SPX files to have `spx_` prefix.
  * Fix all_tests.go test counts
  * Remove now unnecessary OPENSSL_init_cpuid call
  * Clarify BN_uadd and BN_usub's documentation
  * Simplify some unnecessary sign bit juggling
  * Consistently use accessors in service_indicator.c.inc
  * Fix some missing includes in BCM
  * Remove OPENSSL_ia32cap_P references from ChaCha20-Poly1305 assembly
  * Remove OPENSSL_ia32cap_P references from P-256 assembly
  * Mark the CPU capability helpers as const, not just pure
  * Remove some stray debugging
  * Move ecp_nistz256_from_mont out of the header
  * Add DTLS 1.3 sequence number encryption
  * Allow empty passwords in PEM password callback
  * DTLS 1.3 compatibility mode fix in test runner.
  * Rename bcm.c fragments to foo.c.inc
  * Fix some mistakes in build.json
  * Move fork detection support out of bcm
  * Move urandom and OS entropy support out of BCM
  * Add an optional Bazel package to CI
  * Extract C++ files, rather than C, when working around Bazel bugs
  * Fix a couple more IWYU errors
  * Disable parse_headers feature
  * Fix IWYU issue in internal header
  * Support detecting preference for ymm registers over zmm
  * Support detecting AVX512BW, AVX512VL, VAES, and VPCLMULQDQ
  * Fix one of two issues breaking the Bazel build
  * Fix generate_build_files.py
  * Add a pre-generated GN source list
  * Implement X25519MLKEM768 for TLS
  * Update README with new bugtracker links
  * Clarify that ASN1_STRING reprs are not always the DER one
  * Add P-256 KEM to HPKE.
  * Specify the list of Rust files with build.json
  * Remove the unused MLKEM1024_SHARED_SECRET_BYTES
  * Use BSSL_NAMESPACE_{BEGIN,END} macros more consistently
  * runner: Convert a few more of the test stack's parsers to cryptobyte
  * Move ECDSA_SIG out of BCM
  * Don't use weak symbols in the EDK2 build.
  * Specify the list of fuzzers with build.json
  * Add tests for reconstruct_seqnum.
  * Silence clang-tidy warnings in ML-KEM
  * ML-DSA: focus the API on saving private keys as seeds.
  * Fix some ClangTidy nits in ML-DSA.
  * Add ML-KEM.
  * Deprecate the experimental dilithium code.
  * Implement DTLS 1.3 record header.
  * Add ML-DSA.
  * [riscv64] Add qemu-static CIPD dependency for RISC-V checkouts
  * Final cleanup pass in BN_div
  * Remove remaining running pointers in BN_div
  * Split off DTLS record header parsing in test runner.
  * Remove the confusing extra word in BN_div
  * Add Sapphire Rapids to SDE tests
  * Correct DOS line endings.
  * Comment the core BN_div loop
  * Include <string> in pki/string_util.h
  * Add RSA 3072 to bssl SpeedRSA benchmark.
  * Clear AVX512 feature bits when AVX512 not actually supported
  * Size res in BN_div correctly
  * Remove resp variable in BN_div
  * Simplify and clarify the snum padding logic in BN_div
  * Reverse the loop variable in BN_div and assert pointer invariants
  * Clean up some BN_div variable declarations
  * Comment what "normalize" means in BN_div
  * Remove the now impossible BN_R_NOT_INITIALIZED check in BN_div
  * Refactor record header length in test runner.
  * Pass additional parameters to decrypt() in test runner.
  * Fix documentation missed in 82f9853fc7.
  * Cite where BN_div actually comes from
  * Move discussion on BN_div's sign to the headers
  * Update the bn_div_rem_words comment
  * Use "dtls13" label prefix for DTLS 1.3.
  * Update build tools
  * Add preprocessor bits for the EDK2 target.
  * [jumbo] Mark Span and Input as satisfying view and borrowed_range.
  * Add Certs method to CertIssuerSourceStatic to return all certs.
  * CFI tag AES-NI key expansion helpers.
  * Remove util/bot/go/env.py
  * Sort build.json
  * Add virtual destructors.
  * Disable compatibility mode for DTLS 1.3.
  * Add ssl_compliance_policy_cnsa_202407
  * Add runner test support for DTLS 1.25
  * Implement DTLS 1.25
  * Add a comment showing how to update a hash generically.
  * Clarify SCT resumption comment
  * Declare our `cfg()`s in Cargo.toml
  * Add link to 2022 FIPS certificate.
  * Adds functionality for instantiating and using `Algorithm`
  * Use dtls_record_header_write_len instead of DTLS1_RT_HEADER_LENGTH.
  * optimize constant_time_conditional_memxor for gcc
  * Compute should_ack_sni in one place
  * Add ECH fallback API
  * Update Go dependencies
  * Make go mod tidy work better
  * Add QEMU user option for running tests.
  * Add DILITHIUM_public_from_private function.
  * Reapply "Fix test_fips in google3"
  * [DTLS] Use absolute instead of relative epoch numbers.
  * Revert "Fix test_fips in google3"
  * Fix test_fips in google3
  * Ensure CRYPTO_needs_hwcap2_workaround works without CRYPTO_library_init
  * Work around GCC's broken -Warray-bounds warning
  * Rewrite CBS_get_asn1_int64 slightly
  * Make BoringSSL initialization-less
  * Call CRYPTO_library_init before ChaCha20 and P-256 assembly
  * test_fips: two tweaks
  * Add EDDSA support for fetching and uploading vectors
  * test_fips: don't forget a couple of \n's
  * Add the Revision field to third_party/fiat/README.chromium
  * Implement rsa_pkcs1_sha256_legacy.
  * Send a consistent alert when the peer sends a bad signature algorithm
  * Fix pointers in CONSTTIME_DECLASSIFY.
  * Revert "Adds functionality for instantiating and using `Algorithm`" and friends.
  * Remove OPENSSL_ia32cap_P references from AES-NI assembly
  * [bogo] Compute length in record header before encrypting.
  * Remove Knights Landing and Knights Mill logic
  * Extract the AES-NI encrypt -> decrypt assembly conversion
  * Update other CI tools
  * Allow local labels in symbol expressions
  * Handle notrack instructions in delocate output
  * Update Clang in CI
  * Include subcomponents in the bugtracker link
  * Update links to bugtracker
  * Make the bug tracker link be buganizer
  * Make SSL_select_next_proto more robust to invalid calls.
  * Add missing trait "use" in doc tests
  * Test various empty string cases with NPN callbacks
  * Mark kyber as experimental
  * remove un-needed muts which were causing build warnings/errors
  * Adds functionality for instantiating and using `Algorithm`
  * Tidy up dilithium_test.cc
  * Move GCMTest.ByteSwap to crypto_test.cc
  * Fix the indentation in gen/sources.bzl
  * Revert "Move unit tests out of bcm/fipsmodule"
  * Revert "Also extract the test data files from bcm"
  * Fix build with -Wctad-maybe-unsupported
  * Also extract the test data files from bcm
  * Move unit tests out of bcm/fipsmodule
  * Fix some enum issues in the test-only BORINGSSL_FIPS_COUNTERS build
  * Set the minumum TLS version to (D)TLS 1.2 by default
  * Fix the "-with-bazel" branches
  * Don't bother checking for NULL pointers in AES key schedule assembly
  * More ECH certificates
  * Add error string to JSON test result output
  * Add edge-case tests for Dilithium, and fix a bug that sneaked in with the constant-time transformation.
  * Use SEH directives for aes_hw_set_encrypt_key and aes_hw_set_decrypt_key
  * Check DSA size limits in a couple more places
  * The FIPS hash is only 32 bytes, not 64 bytes
  * Enable -expect-curve-id in NotJustKyberKeyShare
  * Disable DilithiumTest.BitFlips test
  * Expose the FIPS module hash at build- and run-time.
  * Reject invalid IPv4 addresses in ipv4_from_asc
  * Move fiat_p256_adx assembly to the right build target
  * use AT&T syntax in fiat_p256_adx
  * Don't define CRYPTO_addc_* and CRYPTO_subc_* in C++
  * Re-add a way to run embed_test_data.go for now
  * Namespace crypto/test/file_util.h
  * Fix the Bazel build
  * Fix alignment of generated UNWIND_INFO structures
  * Add crypto_test_data to the AndroidCMake build
  * Document and test stance on non-canonical base64
  * ACVP updates.
  * Align perlasm SEH directives with gas/clang-assembler
  * Remove no-op register move from ChaCha20_ctr32_ssse3_4x
  * Re-remove redundant OPENSSL_IA32_SSE2 from perlasm commands
  * Replace conf_def.h with straightforward functions
  * Remove X509_STORE_set_get_crl and X509_STORE_set_check_crl
  * Add re-exports for making inline functions available
  * Add HPKE secret export and implement Send for EvpHpkeCtx.
  * Make Dilithium pass constant-time validation
  * bn: Move dispatching logic from x86_64-mont5.pl to C.
  * Add verify.cc and verify.h as top level public API.
  * Add certificates to the remaining ECH client tests
  * Re-apply dilithium and make it work with a limited stack
  * Add tests for some odd escaping behavior in the CONF parser
  * Test some more CONF edge cases
  * Move dispatch from sha512-586.pl to C
  * Allow creation of HKDF using PRK bytes.
  * Remove SSE2 checks in 32-bit x86 assembly
  * [DEPS] Migrate from Chromium git to CIPD
  * Make googletest a full dependency, not a dev_dependency
  * Rename function pointers to avoid shadowing global declaration
  * Don't add extra 'informational' errors in the delegate
  * Remove remnants of C++ runtime workarounds
  * Add a standalone Bazel build
  * Reset DTLS1_BITMAP without resorting to memset
  * Add an OUT_DIR option for finding bindgen output for Android
  * Discuss pointer rules in even more detail in API-CONVENTIONS
  * short-circuit verification on invalid SPKI
  * Add certificates to a couple of tests
  * Change unsupported KEM identifier
  * Add a CLIENT_AUTH_STRICT_LEAF and SERVER_AUTH_STRICT_LEAF which do STRICT requirements on the leaf certificate, and not STRICT on the rest of the chain.
  * Make SSL_CTX_set_keylog_callback constant time
  * clarify a few tests
  * Add some tests for SSL_CTX_set_keylog_callback
  * Switch some pointer arithmetic to spans
  * Disable fork detection for Zephyr and CrOS EC
  * Enable thread support for Zephyr RTOS
  * Fix Zephyr define and description
  * Remove unnecessary NULL checks
  * Avoid strdup in crypto/err/err.c
  * Increase DTLS window size from 64 to 256
  * delocate: handle more SVE2 forms.
  * Disable `-Wcast-function-type-strict` for `BORINGSSL_DEFINE_STACK_OF_IMPL.`
  * Set service indicator for TLS 1.3 KDF.
  * Rewrite RAND_enable_fork_unsafe_buffering documentation
  * Document that our Unicode APIs reject noncharacters
  * Add missing public header for libpki
  * Switch EVP_CIPHERs to C99 initializers
  * Add a PrivacyInfo plist file
  * Make Go an optional build dependency for the CMake build
  * Install the Windows toolchain under util/bot
  * Reflect latest FIPS updates, including 186-5.
  * Update CI build tools
  * [rust] Tell Cargo to link cpp runtime library
  * Update run_android_tests to exit on invalid ABI
  * Move fips_fragments into bcm.internal_hdrs in build.json
  * Move internal headers to build.json
  * Flatten crypto/CMakeLists.txt into the top-level
  * Move crypto_sources to build.json
  * Specify public headers in build.json
  * Rework the test data story
  * Move the rest of sources.cmake into util/pregenerate
  * Use source lists to find pki_test data in run_android_tests.go
  * Move test data lists to util/pregenerate
  * Support glob patterns in build.json
  * Correctly sort err_data.c inputs
  * Regenerate err_data.c
  * Check in pre-generated perlasm and error data files
  * Flatten crypto/fipsmodule/CMakeLists.txt up a layer
  * Document that null STACK_OF(T) can be used with several functions
  * Remove unused flags argument from trust handlers
  * Build fips_shared_support.c as part of libcrypto
  * Make it plainly obvious this is experimental code.
  * Add some barebones support for DH in EVP
  * Add verify_errors as public error API
  * Fix EVP_PKEY_CTX_dup with EC generation
  * Start making asserts constant-time too
  * Clear some more false positives from constant-time validation
  * Fix X509_ALGOR_set_md()
  * Trim unused files from PKI_TEST_DATA
  * Remove unnecessary LINKER_LANGUAGE setting in CMake build
  * Move ssl and decrepit sources to sources.cmake
  * Add threading documentation to DH and DSA
  * Make EVP_PKEY_type into the identity function
  * Move EVP_PKEY setters to their corresponding type-specific files
  * Avoid EVP_PKEY_set_type in EVP_PKEY_new_raw_*_key
  * Remove some unnecessary dependencies on EVP_PKEY_set_type
  * Gate -Wframe-larger-than on Clang 13
  * Make ninja run_tests output less confusing
  * X509_ALGOR_set_md is a mess, document it
  * Filter out DW.ref.__gxx_personality_v0 in read_symbols.go
  * Remove unused app_data from EVP_CIPHER
  * Re-remove unnecesary stat calls from by_dir.c
  * Add a regression test for error handling and hash_dir
  * Fix spelling of Identifier
  * Revert "Remove unnecessary stat calls from by_dir.c"
  * Don't dereference hs->credential on TLS 1.2 PSK ciphers
  * Add ERR_lib_symbol_name and ERR_reason_symbol_name
  * Add BIO_FP_TEXT
  * Fix a number of cases overwriting certificates, keys, etc. with SSL_CREDENTIAL
  * Set -Wframe-larger-than=25344 for a typical cmake clang compile.
  * Make crypto_test build with -Wframe-larger-than=25344
  * Revert "Add a Dilithium implementation."
  * Fix sha1 dynamic dispatch issues.
  * Remove an unused runner/shim flag in SSL tests
  * Only negotiate ECDHE curves and sigalgs once
  * Add an SSL_CREDENTIAL API for ECDSA/RSA and delegated credentials
  * Rename CRYPTO_get_ex_new_index to CRYPTO_get_ex_new_index_ex
  * Remove unused group_id parameter in TLS 1.3 cipher suite selection
  * Check ECDSA curves in TLS 1.2 servers
  * Inline CBS_init, CBS_data, and CBS_len
  * Check client certificate types in TLS <= 1.2
  * runner: Add a test for hint mismatch due to public key
  * Add a Dilithium implementation.
  * Tidy up Rust HPKE binding.
  * Move spx from internal to include/openssl/experimental
  * runner: Configure all relevant fields from the Credential type
  * runner: Rename CertificateChain to Credential
  * Align CRYPTO_get_ex_new_index with the public API's calling convention
  * Make bssl_shim's setup logic infallible
  * Slightly simplify ssl_x509.cc
  * Forbid RSA delegated credentials
  * Fix delegated credential signature algorithm handling
  * Make DelegatedCredentials-KeyMismatch test less confusing
  * Use slices.Contains in ssl/test/runner
  * Fold ssl_add_cert_chain into its caller
  * runner: Remove the ability to configure multiple certificates
  * runner: Use go:embed
  * Generate certs on the fly in runner, pass trusted cert to shim
  * Make pki_sources available to Soong
  * Finish documenting x509.h
  * Add safety coments to bssl-sys
  * Test X509_verify_cert with CAs that share a name
  * Document the remaining struct types in x509.h
  * Expand and document the remaining DECLARE_ASN1_* macros
  * Unexport i2d, d2i, and ASN1_ITEM for X.509 interior types
  * Document filesystem-based X509_STORE APIs
  * Document APIs relating to built-in and custom extensions
  * Add tests for what happens when no certificate is configured
  * Introduce a test helper for asserting on the error
  * Make an include/openssl/experimental. Move kyber to it for now.
  * Deprecate and simplify SSL_CTX_check_private_key
  * Use a more fine-grained lock in by_dir.c
  * Remove unnecessary stat calls from by_dir.c
  * Use std::copy instead of OPENSSL_memcpy for the internal bssl::Array::CopyFrom
  * Consistently open files in binary mode on Windows
  * Add some tests for X509_LOOKUP_hash_dir
  * Add some utilities for testing temporary files
  * Remove redundant piece of DC state
  * Test an unusual split between context and connection configuration
  * Remove redundant bssl_sys import
  * Remove some impossible null checks
  * Remove some indirection in SSL_certs_clear
  * Make an internal RefCounted base class for libssl
  * Const-correct the 'kstr' parameter of PEM functions
  * Implement Hybrid Public Key Encryption in Rust.
  * Use BIO_TYPE_* constants for flags
  * Move capability checks in sha256-586.pl to C
  * Integrate TLS 1.2 sigalg and cipher suite selection
  * Remove old "check for P4" in sha256-586.pl
  * Document some miscellaneous x509.h functions
  * Move capability checks in sha1-586.pl to C
  * Write down the bounds for the sha*_block_data_order functions
  * Move capability checks in chacha-x86.pl to C
  * Remove OPENSSL_IA32_SSE2 checks in x86 perlasm
  * Update delegated credentials to the final RFC
  * Don't report libpki headers as part of libcrypto
  * Add a no-op OPENSSL_INIT_NO_ATEXIT
  * bssl-crypto: remove unused code.
  * Add x509.h to doc.config
  * Unexport DIST_POINT_set_dpname
  * Allow a C++ runtime dependency in libssl
  * Rewrite the warning about X509_AUX
  * Remove pki/tag.h
  * Work around bindgen bug around constants
  * Guard C++ headers.
  * Include verify_unittest files in PKI_TEST_DATA
  * Switch to bindgen's static inline support
  * Document X509_V_FLAG_*
  * Merge X509_PURPOSE/X509_TRUST IDs and indices
  * Unexport most of X509_TRUST and X509_PURPOSE and simplify
  * Remove X509_TRUST_DEFAULT
  * Add X509_STORE_get1_objects
  * Mark ASN1_STRFLAGS_* and XN_FLAG_* with the right type
  * Remove unused include in now public header
  * Move signature_verify_cache.h to openssl/pki as public api
  * Make ContainsError look only for Errors, not Warnings.
  * Don't assume that Fiat assembly is available on Windows.
  * Add public API for a certificate.
  * Allow the delegate to indicate it wishes to accept PreCertificates when building chains.
  * Use uint64_t for num_read and num_write in BIO
  * Add functions to convert from Span<const uint8> and std::string_view
  * Minor formatting fixes
  * Expose OPENSSL_timegm in posix_time.h
  * Add SSL_get0_chain method
  * Tighten up the warning about RSAES-PKCS1-v1_5
  * Avoid conversion overflow from struct tm.
  * Ensure additions in this call can't overflow.
  * Create a new NameConstraints constructor that takes in an already constructed GeneralNames object for permitted names.
  * Fix strict aliasing issues with DES_cblock
  * Require SSE2 when targetting 32-bit x86
  * Remove unused files from pki
  * Move NEON dispatch in bn_mul_mont to C
  * Rewrite bn_big_endian_to_words to avoid a GCC false positive
  * Enable SSE2 intrinsics on MSVC
  * Rename <openssl/time.h> to <openssl/posix_time.h>
  * Tweak generate_build_files.py output to pass gn's formatter
  * Remove remnants of the old Android CMake toolchain
  * bn: Move ia32cap_P references from x86_64-mont.pl to C.
  * Stop generating unused assembly for 32-bit iOS
  * Fix SHA ABI tests
  * sha: Move Armv7 dispatching to C (reland)
  * bn: Move x86-64 argument-based dispatching of bn_mul_mont to C.
  * Import upstream's tests for DES_ede3_cfb_encrypt
  * Move single-use macros from internal.h to des.c
  * Unexport uint32_t-based DES APIs
  * Import upstream tests for CVE-2024-0727
  * aes gcm: Remove Atom Silvermont optimizations.
  * Arrange other X509_STORE, etc. symbols into sections
  * Simplify purpose checks
  * Stop processing the Netscape cert type extension
  * Remove X509_STORE_CTX_purpose_inherit
  * Document and test X509_PURPOSE and X509_TRUST machinery
  * Fix threads detection for CROS_EC/CROS_ZEPHYR
  * Stop passing der::Input by const-ref
  * Make der::Input a little closer to Span
  * Remove pki/patches
  * Document assumptions made by bssl-crypto's unboxed HMAC_CTX
  * delocate: update to handle SVE2
  * Use four-iterator std::equal for bssl::Span::operator==
  * Avoid unions in CCM
  * Reworking bssl_crypto: don't use zero keys in examples.
  * Fix AES-GCM-SIV with huge inputs on 32-bit.
  * Reworking bssl_crypto: support AES-GCM-SIV open_gather.
  * Reworking bssl_crypto: bump version and fix license.
  * Reworking bssl_crypto: Sync+Send for ECC and RSA.
  * Reworking bssl_crypto: tidy up module list.
  * Reworking bssl_crypto: Add RSA support
  * Reworking bssl_crypto: Ed25519
  * Reworking bssl_crypto: add ECDSA support
  * Reworking bssl_crypto: rand
  * Reworking bssl_crypto: ECDH
  * Reworking bssl_crypto: make with_output_array_fallible use a bool.
  * Reworking bssl_crypto: AES
  * Reworking bssl_crypto: AEAD
  * Clarify that X509_NAME_hash(_old) are specific to hash-dir
  * Reduce the BER conversion recursion depth
  * Fix a bug detecting BER deeply nested inside DER
  * Replace CONF's internal representation with something more typesafe
  * Elaborate a bit on static vs dynamic EC_GROUPs in documentation
  * Have generate_build_files.py output Rust sources.
  * Make the debug vs release build note in BUILDING.md more prominent
  * Simplify Montgomery RR precomputation.
  * Update build tools on CI
  * Disable the __SHA__ static check for now
  * Update Go dependencies
  * Clear some false positives in constant-time validation
  * Fix segfault if CRYPTO_set_thread_local fails and calls rand_thread_state_free.
  * Move CRL_REASON_* back to x509v3.h
  * Reworking bssl_crypto: HMAC
  * Reworking bssl_crypto: HKDF
  * Reworking bssl_crypto: imports_granularity = "Crate"
  * Reworking bssl_crypto: digest
  * Reworking bssl_crypto: x25519
  * Revert "sha: Move Armv7 dispatching to C"
  * acvp: test with internal nonce generation.
  * chacha: Move x86-64 CPU & length dispatching from assembly to C.
  * Do not condition CRYPTO_is_RDRAND_capable on __RDRND__
  * Fix PKI test data list in sources.cmake
  * Remove all -1 returns from X509_check_purpose
  * Add some more TSan tests for crypto/x509
  * Don't define OPENSSL_LINUX for CROS_EC and CROS_ZEPHYR
  * Remove X509_TRUST_OCSP_SIGN and X509_TRUST_OCSP_REQUEST
  * Remove X509_{PURPOSE,TRUST}_{MIN,MAX}
  * Some miscellaneous openssl/x509.h documentation fixes
  * Const-correct a bunch of X509_STORE_CTX functions
  * Move some deprecated X.509 functions into the deprecated section
  * Const-correct X509_alias_get0 and X509_keyid_get0
  * Add a missing error check for sk_X509_push
  * Fix error-handling convention in x509_vfy.c and avoid -1 returns
  * Forbid unusual return values out of verify_cb
  * get_issuer can never return -1
  * Make X509_V_FLAG_NOTIFY_POLICY into a no-op
  * Remove X509_STORE_CTX_get0_current_issuer
  * Test the X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE codepath
  * Remove remnants of Netscape Server Gated Crypto from the new verifier
  * Make configure_callback in x509_test.cc take the X509_STORE_CTX
  * Use X509_get0_pubkey to simplify things slightly
  * Eagerly compute the cached EVP_PKEY in X509_PUBKEY
  * Test signature verification in X509_verify_cert
  * Fix X509_PUBKEY_set0_param to clear the cached EVP_PKEY
  * Do a better job testing expiration checks
  * Allow for the path builder to limit the number of valid paths.
  * Warn more explicitly not to use the callback in SSL_set_verify
  * Simplify some logic around X509_verify_cert callbacks
  * Remove X509_STORE_set_get_issuer
  * chacha: Move 32-bit Arm CPU dispatch from assembly to C
  * chacha: Move ARMv8 OPENSSL_armcap_P dispatching from assembly to C.
  * Restore the X509_EXTENSION ASN1_ITEM too
  * Give WARNING paragraphs a splash of color
  * Support lists and code blocks in doc.go
  * sha: Add SSSE3 check to SHAEXT SHA-256 implementation.
  * Give time.h a title and move to low-level infra group
  * Restore the X509 ASN1_ITEM
  * Add conf.h to the documentation output
  * Skip emitting empty <pre> blocks in documentation
  * Support medium memory models.
  * Change certificate depth limit to match OpenSSL and document
  * Fix X509_ATTRIBUTE_set1_data with negative attributes
  * sha: Move Armv7 dispatching to C
  * Disable 32-bit Arm assembly optimizations on iOS
  * Assume the Arm assembler can handle ADR
  * Document and fix up name hashing functions
  * sha: Remove check for SSSE3 for AVX variants.
  * Document functions that export verification internals
  * sha: Move AArch64/X86-64 dispatching to C.
  * Remove cert_verify_proc_blocklist.inc
  * Call CheckPathAfterVerification in deadline/iteration limit case
  * Fuzz more extension parsers in the cert parser
  * Document GENERAL_NAME-related APIs
  * Remove unused Chromium test data
  * Remove fillins/log.h
  * Unexport some STACK_OF types.
  * Const-correct X509_TRUST and X509_PURPOSE
  * Remove dynamic X509_TRUST and X509_PURPOSE registration
  * Actually remove KU_* from x509.h
  * Add distrust by SPKI to TrustStoreInMemory
  * Move KU_* back to <openssl/x509v3.h>
  * Document or unexport some more of x509.h
  * Add missing include
  * Consistently call CRYPTO_free_ex_data first
  * Fix the names of some X509_STORE_CTX functions
  * Simplify and document X509_VERIFY_PARAM inheritance
  * Add a debugging log facility to the delegate.
  * Unexport X509_VERIFY_PARAM_lookup
  * Fix build with -Wmissing-field-initializers
  * Remove X509_VERIFY_PARAM_get0_peername
  * Document some key usage accessors
  * Simplify and document X509_supported_extension
  * Const-correct X509_LOOKUP_METHOD
  * Fix KYBER_decap declaration
  * Replace X509_LOOKUP_ctrl with real functions
  * Name the hash functions in the Kyber implementation
  * Pull the string-based extensions APIs into their own section
  * Always use a 32-byte shared secret for Kyber
  * Tidy up x509_lu.c functions a little
  * Clean up the by_file_ctrl x509 code to be slightly less obtuse
  * Use relative links in markdown files
  * Merge <openssl/x509v3.h> into <openssl/x509.h>
  * Merge crypto/x509v3 into crypto/x509
  * Simplify X509_VERIFY_PARAM_new and X509_VERIFY_PARAM_free
  * Remove X509_VERIFY_PARAM names
  * Add a value barrier in p224_select_point
  * Add CRYPTO_{addc,subc}_* functions to crypto/internal.h
  * Implement the old FIPS 186-2 PRF
  * Document some X509_VERIFY_PARAM and X509_STORE functions
  * Remove a pile of unused X509_STORE callbacks
  * add checkout command to BUILDING.md
  * Move X509_INFO back into x509.h and document
  * Give BIO an ex_data
  * Remove fillins/openssl_util
  * Remove unused fields in X509_LOOKUP and X509_LOOKUP_METHOD
  * Fix some docs.go nits
  * Unexport various unused X509_OBJECT and X509_LOOKUP functions.
  * Add X509_OBJECT_new and X509_OBJECT_free
  * Fix leak if X509_STORE_CTX_init is called on a previously initialized context
  * Remove fillins/path_service
  * Remove fillins/fillins_base64
  * Remove fillins/file_util
  * Remove fillins/fillins_string_util.[cc|h]
  * Remove X509_STORE_CTX_zero
  * Update README.md
  * Remove IMPORT and related importing tools
  * Use InsertBraces - and reformat pki as such
  * Clang-format all of pki.
  * Trim X509_INFO and move to crypto/pem
  * Document ASN1_ITEM-based signing, etc. APIs
  * Unexport some ASN1_ITEMs that aren't used externally
  * Document X509_NAME comparison functions
  * Document PKCS8_PRIV_KEY_INFO and X509_SIG
  * Document X509_PUBKEY functions
  * Remove pki/fillins/net_errors.h
  * Remove the _BORINGSSL_LIBPKI_ defines
  * Remove no longer reachable CRL path validation code
  * Remove support for the certificateIssuer CRL entry extension
  * Use the ASN1_BOOLEAN typedef in ISSUING_DIST_POINT
  * Unexport the idp_flags constants
  * Remove some remnants of indirect CRLs in CRL matching
  * Remove the delta CRL special case on expiry
  * Remove the now no-op CRL reasons loop
  * Don't process DistributionPoints with a reasons field
  * Remove the redundant idp_reasons field
  * Remove removedFromCRL handling
  * Remove dcrl output parameter in CRL lookup logic
  * Don't parse delta CRL and CRL number extensions
  * Remove EXFLAG_FRESHEST
  * Remove delta and extended CRL support
  * Manually unroll pi and rho steps in Keccak
  * Don't prematurely run keccak_f in squeeze
  * Remove X509_CRL_diff
  * Expand and document RSA_PSS_PARAMS functions
  * Document X509_REVOKED-related functions
  * Const-correct and document trust/reject object APIs
  * Limit the SHA_CTX workaround to C
  * Simplify AES-GCM counter increment
  * Remove unnecessary length check before OPENSSL_memcpy
  * Test EVP_CTRL_AEAD_SET_IV_FIXED and friends
  * Tighten the limit in ASN1_STRING_set further
  * Fix delocate build rules with make
  * Add basic C implementation of SPHINCS+-SHA2-128s.
  * Update Go dependencies
  * do not call memcpy directly in curve25519_64_adx.h
  * Skip ForkDetect tests on iOS
  * Add ALPS codepoint supports for split handshake
  * Add missing include for waitpid
  * Add a note about the list in target.h
  * Teach delocate about a new directive that Clang is using.
  * Make the pki private headers available to gn
  * Sync pki to chromium 5934e28579cddeae3d9ae5b5974f8aae31f200dd
  * Move Keccak code to its own folder and add an absorb API.
  * Add support for fork detection via pthread_atfork()
  * Error check X509_ALGOR_set0()
  * Add some IWYU export pragmas
  * Convert X509_NAME_get_text_by_[NID|OBJ] to return UTF-8
  * crypto: remove kBoringSSLBinaryTag
  * Export OPENSSL_NO_* defines in bssl-sys for consumption in rust-openssl
  * Improve X509Test.NameAttributeValues coverage
  * Edit bssl-sys setup instructions.
  * Store NID_undef's ASN1_OBJECT outside the table
  * Don't include NID_undef in short/long name tables
  * Remove asn1_ex_clear from ASN1_EXTERN_FUNCS.
  * Avoid GCC's -Wdangling-pointer warning in CBB
  * Replace remaining references to __ARM_ARCH__ with __ARM_ARCH
  * Update tools on CI
  * Add support for 32bit break tests on Android.
  * Fix path for modifiable libcrypto used in KAT testing.
  * Add new asm files to generate_build_files.py
  * sync pki to chromium 248754f767a6df29d26ebb7da231f22713924a7d
  * Consistently use SIZE_MAX over (size_t)-1
  * Also add OPENSSL_calloc
  * Add OPENSSL_zalloc
  * Add table-independent x86+adx asm for P-256
  * Implement bssl-crypto wrappers for AES-CBC
  * Add a comment for what compiler_test.cc is about
  * Sync pki to chromium eddbcb143c7462e0b8d60e859b96d678ca0c013c
  * Stop rewriting ret to repz ret on x86_64
  * Make bssl-crypto no_std compatible
  * Bump the minimum CMake version to 3.12
  * CMake doesn't have an error function
  * Require C11 in MSVC too
  * Add support for the new ALPS codepoint
  * Expose curves for ECDH
  * Sync pki to chromium ce4bc9571462aa298d79b591df9d997323cf5157
  * Help the compiler dedup ia32cap and armcap accesses
  * Automatically call CRYPTO_library_init before C accesses
  * acvptool: create fresh variables in loops.
  * Sync pki to chromium 1ef93e346424a24fa27ee55a36254b6ee0f96e86
  * Update googletest and include googlemock
  * Return the correct value in EVP_CIPHER_CTX_iv_length after EVP_CTRL_AEAD_SET_IVLEN
  * Add X25519 bindings for bssl-crypto
  * Add ecdh and P256 bindings to bssl-crypto
  * Update the warnings on split handshakes and handshake hints
  * runner: Check that the shim HRRs echo the session ID
  * Reland "Build with C11 on MSVC in the standalone Bazel build"
  * Fix cargo clippy and fmt
  * delocate: accept more directive expressions
  * Initialize libunwind cursors from the signal handler's ucontext_t
  * Remove another decltype(fclose)
  * Save trampoline state in unwind tests more straightforwardly
  * Explicitly mark saved registers with .cfi_restore
  * Remove undesired OPENSSL_EXPORT's in non-library code
  * Fix RBP-based unwind in fiat assembly
  * Remove another OPENSSL_EXPORT in an enum
  * Silence warn_unused_result warning on write() call
  * Remove OPENSSL_EXPORT from enum in fillins/net_errors.h
  * Ensure OPENSSL_EXPORT is only on the class not methods.
  * Add pki file lists to generated gn build files
  * Add Rust bindings to AES_CTR through EVP_* cipher API's
  * Export CBS/CBB unicode functions
  * rename fillins/string_util.h because gn is special
  * rename fillins/base64.c to handle gn being special
  * Also suppress OPENSSL_LINUX for nanolibc
  * Add BN_bn2lebinpad and BN_lebin2bn
  * Use a callable type for ScopedFILE in settings_writer.cc
  * Add Rust bindings to AES-GCM through the EVP_AEAD_* APIs
  * Deduplicate the three copies of OBJ_cmp
  * Remove header file accidentally added to sources.cmake
  * Sync pki to chromium d740199e083b70d13506973c6f479f0b01165a05
  * Move the fuzzers into the fuzz directory and make them build.
  * Fix typo in .size directives for aesni_gcm_encrypt
  * Hook in ocsp into libpki, and run the ocsp unit tests.
  * Update pki to chromium cf9a08ff8be3a3f2d5b13693cc13ef22ab7ee618
  * Make a BSSL_CHECK that always aborts
  * Add rust bindings to AES-GCM-SIV through the EVP_AEAD_* API's
  * Add EVP_HPKE_KEY_move
  * Default to q = (p-1)/2 for DH keygen
  * Remove the CRYPTO_is_*_capable_at_runtime indirection
  * Select SHA-256 vs SHA-512 explicitly in perlasm
  * Hash-to-curve is now RFC 9380
  * Add the rest of the new test data files to sources.cmake
  * Align DH keygen with NIST's formulation when q is available
  * add missing test file to sources.cmake
  * Consistently reject large p and large q in DH
  * use <errno.h> instead of <sys/errno.h>
  * Document and test DH_generate_key's weird key reuse behavior
  * Sync pki to chromium 8049b24a3fa617e66c5d3fc0e9322bb07c500f49
  * Add a basic sanity test for getentropy() if we are using it.
  * Add ChromeOS EC related targets
  * Add rust API instability warning
  * Fix FFI slice usage
  * Remove the remaining old-style asm lists
  * Remove the old asm lists from JSON and android-cmake output
  * Disable assembly for Android's darwin build
  * Split TLS 1.0 and 1.2 self checks.
  * MD5 and SHA-1 are not actually approved in the TLS KDF.
  * Restore OPENSSL_RAND_TRUSTY
  * Remove old asm source lists from Android sources.mk
  * Trim some redundant Arm feature detection files
  * Stop duplicating the OPENSSL_armcap_P declaration
  * arm64: Implement baremetal OPENSSL_cpuid_setup
  * Switch the generated Soong (Android) build to the new asm source list
  * Restore fuzz/session_corpus
  * Mark all of bssl::Span as constexpr
  * Sync pki to chromium aef592bb1b83f019c8342bbc2c476758ccb6098d
  * Reflect OPENSSL_NO_SOCK and OPENSSL_NO_POSIX_IO into headers
  * Use a stub fopen implementation when OPENSSL_NO_FILESYSTEM is set
  * Link Googlers to the new porting policy doc
  * Make the parse_certificate_fuzzer from libpki work inside boring.
  * Fix the missing header issue for OPENSSL_NO_SOCK
  * Mark the old sk symbols as deprecated
  * Temporarily restore sk_pop_free_ex
  * Sync pki with chrome 6d4f9e7881fe07cf46eafd3245db2c8829e312f4
  * Add pki to generate_build_files.py
  * Silence -Wformat-truncation warning in crypto/err/err.c
  * Tidy up error handling for sockets vs fds
  * Test non-blocking socket BIOs
  * Unconditionally include BIO_set_fd and BIO_get_fd
  * Support Android's "baremetal" target
  * add pki test data to sources.cmake
  * remove duplicates that make bazel unhappy
  * Silence -Wformat-truncation in newer GCCs
  * Update RSATest.BadKey to use a plausible key size
  * Replace BIO_snprintf with snprintf within the library
  * Fix error handling in bssl_shim socket object
  * Define _DEFAULT_SOURCE for getentropy in musl
  * [ssci] Added Shipped field to READMEs
  * Add combined source lists to the other generators
  * Remove old style asm source lists for GN and Bazel
  * Clarify what __TRUSTY__ and OPENSSL_NANOLIBC are
  * Temporarily disable the Trusty CRYPTO_sysrand implementation
  * Fix aarch64 build with GCC
  * Fix error condition in new iOS CRYPTO_sysrand
  * Make the old sk_* functions into full functions
  * Move file_test_gtest.cc to CRYPTO_TEST_SOURCES for now
  * Use constant curve-specific groups whenever possible
  * [acvptool] skip connection to the server if input json or regdump is on
  * Entropy changes for trusty and windows.
  * Use std::make_unique when possible
  * Make built-in curves static.
  * Update the documentation of RAND_cleanup
  * Resolve an old TODO in TestState::Deserialize
  * Fix truncation warnings with the iteration count
  * sync pki to chrome 6e6fa5a08b94199de10eea22845963baf548628b
  * Fix spelling nits
  * Clear some size_t truncations
  * Add Intel Indirect Branch Tracking support.
  * Embed the generator into EC_GROUP
  * Const-correct a handful of time functions
  * Don't include stdalign.h in refcount.c
  * Fuchsia has getentropy() via musl - use it and drop the custom file
  * Remove remnants of malloc.cc
  * Embed BN_MONT_CTX into EC_GROUP.
  * Move to preferring getentropy() for system provided entropy
  * Use sources.cmake for the bssl tool
  * Fix Android shared library tests
  * Use sources.cmake for the test_support library
  * Use sources.cmake for test binaries
  * Don't store a redundant copy of the EC_GROUP field modulus
  * Revert "Build with C11 on MSVC in the standalone Bazel build"
  * Configure explicitly whether to shard tests
  * Use sources.cmake for pki and pki_test
  * Remove field_minus_order from EC_GROUP.
  * Use file(STRINGS) to read go_tests.txt
  * Use individual files for lists of source files.
  * Sync pki to chrome 28e4a1b838b2ffbf9e2151ae5fcfffe5ab0ffac0
  * Build with C11 on MSVC in the standalone Bazel build
  * Replace byteBuilder and byteReader with cryptobyte
  * Don't store a redundant copy of the order in EC_GROUP
  * Make the curve compat APIs into real functions
  * Add pki test files for android, adapt PathService fillin.
  * Remove some unused fields
  * Temporarily add sk_new_null, etc., wrappers in bssl-sys
  * Fix libpki build
  * Fix the Windows fuzzer build
  * Consistently include BTI markers in every assembly file
  * Use ProcessPrng instead of RtlGenRandom on Windows
  * Bring in the core of  chromium certificate verifier as libpki
  * Slightly tidy BIO_C_SET_FILENAME logic
  * Credit CryptOpt in third_party/fiat/README.md
  * Start recognizing the OPENSSL_NANOLIBC define
  * Use a single TCP server port in runner
  * Simplify shimProcess accept and wait
  * Turn SocketCloser in bssl_shim into a proper owning type
  * Pass IPv6 vs IPv4 down to the shim
  * Add more tests for recognizing explicit forms of built-in curves
  * Log failure to create SSL objects in handshakers
  * Remove -D__ASSEMBLER__=1 when shelling out to the preprocessor
  * Remove p > q normalization in RSA keys
  * Implement BN_MONT_CTX_new_consttime with Montgomery reduction
  * Make bn_mod_lshift_consttime faster
  * Fix tests on Arm when NEON is unavailable
  * Fix fiat asm .private_extern declaration on Apple platforms
  * Don't expose EVP_PKEY internal representation through EVP_PKEY_assign
  * Add memcmp binding to bssl-crypto
  * Remove CRYPTO_MUTEX from public headers
  * Make RSA opaque
  * Add target attributes to curve25519_64_adx.h
  * Add ASN1_TIME_set_string_X509
  * Don't allow timezone offsets in ASN1_UTCTIME_set_string
  * Add SSL_CIPHER_get_handshake_digest
  * Const-correct a few X509_PURPOSE and X509_TRUST functions
  * Tidy bssl-crypto documentation
  * Avoid another NULL+0 in BIO_s_mem
  * Remove a layer of indirection from fiat curve25519 assembly
  * Fix the combined asm source lists in generate_build_files.py
  * Update build tools
  * Give up on qsort for sk_FOO_sort
  * Remove a pointer indirection in STACK_OF(T) comparisons
  * Add fiat_curve25519_adx.S to generate_build_files.py
  * Prefix the private stack functions
  * Add .type, .hidden, and .size to the new fiat ADX assembly
  * Use ADX asm for Curve25519 base-point multiplication
  * Make DSA opaque
  * Add saturated X25519 for x86_64+ADX running Linux
  * Handle ChaCha20 counter overflow consistently
  * Use packed representation for large Curve25519 table
  * Add SHA256 and SHA512 bindings to bssl-crypto
  * Make BN_mod_inverse() deal with repeated arguments
  * Remove BN_DEC_FMT2 and test the others
  * Define TLSEXT_nid_unknown
  * Constant-time test that X25519 has a single path.
  * Add a value barrier when checking for point doubling.
  * Align NIDs vs group IDs in TLS group APIs
  * Align remaining TLS ECDH APIs on "group" terminology
  * Align on using the "group" over "curve" for ECDH in TLS
  * Remove SSL_CIPHER_get_value
  * add rust bindings for ed25519
  * Add an ABI test for x25519_NEON
  * Add constant-time validation for curve25519
  * Add prefetch to aes_hw_ctr32_encrypt_blocks
  * Remove variable expansion from CONF fuzzer
  * Remove some unreachable character types in the CONF parser
  * Remove some unnecessary NULL checks in conf.c.
  * Test the CONF parser more extensively
  * Miscellaneous size_t truncation fixes
  * Add int casts as needed around STACK_OF(T) sizes and indices
  * Bound STACK_OF(T) sizes by int
  * acvptool: clean up better.
  * Avoid locks in CRYPTO_free_ex_data
  * Disable TLS_RSA_WITH_3DES_EDE_CBC_SHA by default
  * Don't include <stdatomic.h> in C++
  * Add a comment about the Chromium sandbox for macOS sysctls
  * Update hkdf.c to avoid potentially vulnerable code pattern.
  * Fix RAND_enable_fork_unsafe_buffering when called after fork
  * Add a thread test for ex_data
  * Remove read locks from PRNG steady state
  * Add an atomics library to crypto/internal.h
  * Remove the lock-based atomics fallback
  * Use Windows Interlocked* APIs for refcounts when C11 isn't available
  * Reject RSA keys under 512 bits
  * Check public components in freeze_private_key
  * Remove now redundant RSA test
  * Add documentation for X509_STORE_CTX_set_verify_cb and friends
  * Add a multi-threaded mode to bssl speed
  * Use a helper function to implement get_all_foo_names functions.
  * Cap the input size to the conf fuzzer
  * acvptool: implement pipelining.
  * Update googletest
  * Update build tools
  * OpenBSD Support
  * Remove unions in BLAKE2b implementation
  * Bump the minimum supported MSVC version to VS2019
  * Add APIs to query a list of possible strings for TLS features
  * Add back support for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  * Fix PKCS8Test to not rely on RSA-512
  * Add a more general mechanism for deprecating TLS ciphers
  * Add APIs to support RSA keys with large e.
  * Remove unions in GCM implementation
  * Rename EC_RAW_POINT to EC_JACOBIAN
  * Clarify that X25519 also supports EVP_PKEY_new_raw_private_key, etc
  * Align Kyber names with draft-tls-westerbaan-xyber768d00
  * Remove unions in polyval implementation
  * Remove H from GCM128_KEY
  * Don't make assumptions about GCM128_CONTEXT layout in aesni-gcm-x86_64.pl
  * Don't make assumptions about GCM128_CONTEXT layout in aesv8-gcm-armv8.pl
  * Implement the AuthEncap/AuthDecap HPKE modes
  * Update references to draft-irtf-cfrg-gcmsiv
  * Replace interface{} with any
  * Add new APIs for creating RSA keys
  * Disable BlindingCacheConcurrency on FreeBSD.
  * Add Kyber to runner tests
  * Invalidated cached RSA, DH, and DSA state when changing keys
  * Support WPA 3.1 "enterprise" mode.
  * runner: Remove an unnecessary use of AllCurves
  * Move the old SPKAC types to their own section
  * Remove unimplemented SSL BIO_ctrl values
  * Don't copy all of bssl-sys into the CMake build directory
  * Remove go:build ignore from convert_wycheproof
  * X509_sign, etc., should return the length of the signature on success
  * Add some missing includes
  * Specify the TLS cipher order more straightforwardly
  * Squeeze a block at a time when computing the matrix in Kyber
  * Align TRUST_TOKEN_pst_v1_voprf with draft-21 of VOPRF
  * Re-add go:build ignore lines
  * Move convert_wycheproof into its own package
  * Allow passing extra flags to BoGo shim
  * Remove TLS_RSA_WITH_NULL_SHA
  * Only rerun bindgen when its dependencies change
  * Add mechanism for deprecated declarations.
  * Spell includes in wrapper.h like the rest of the project
  * Replace sort.Sort with sort.Slice
  * Fix allowlist regex in bindgen invocation
  * Update docs to recommend a much more convenient CMake invocation
  * Trim some unused XN_FLAG_* values
  * Remove --size_t-is-usize from bindgen call
  * Clarify in ssl.h documentation not to use the verify callback
  * Move the X509 time functions under "Convenience functions"
  * Remove the X509at_* functions
  * Organize X509_ATTRIBUTE functions into sections.
  * Document a pile of X509 print functions
  * Generate 64-bit Curve25519 and P256 code for MSVC
  * Widen ASN1_mbstring_copy and ASN1_mbstring_ncopy to ossl_ssize_t
  * Update test_fips.c with new functions added to FIPS module.
  * break-tests.sh: break run-time tests and use two test_fips binaries.
  * Skip some BIO_gets tests if tmpfile fails on Android
  * Switch to new ACVP test for TLS 1.2 KDF.
  * Default SSL_set_enforce_rsa_key_usage to enabled.
  * add extra lints to align with Chromium rust toolchain
  * Include bindgen generated file via a build time env var, this plays nicer with other build systems like Soong and Gn.
  * Move TLS 1.3 KDF functions into the FIPS module.
  * Move HKDF into the FIPS module.
  * Drop CECPQ2 support.
  * expose a reset API on hmac which resets the current instance back to its original state keeping the same key as initially used
  * Remove X509V3_EXT_add_list and X509V3_EXT_cleanup
  * Remove support for "old-style" X509V3_EXT_METHODs.
  * Restore some default cases in tasn_dec.c and tasn_enc.c
  * Add functions to allow the mocking of AES hw support for testing.
  * Fix up do_ext_i2d's error-handling
  * Add Trust Token version using standardized hash2curve.
  * Move RSA (en|de)cryption out of the FIPS module.
  * leaked_storage in method POLICYQUALINFO *notice_section
  * Fix miscellaneous size_t truncations
  * Remove SSL_CIPHER_get_rfc_name
  * Run `go fmt` in `ssl/test/runner`.
  * If the ret is not null, it needs to be released before return
  * Don't consume the newline in BIO_gets for fds
  * RESOURCE_LEAK in method STACK_OF(TRUST_TOKEN) *voprf_unblind before return 0
  * Tidy up some lengths in SSL_SESSION
  * Fix size_t truncations in bio_mem.c
  * Convert a few more ints to bools in libssl.
  * Add various tests for memory BIOs.
  * Update X25519+Kyber ID.
  * Add comment about regenerating peg files.
  * Adding a C implementation of Kyber.
  * Fix handling of critical X.509 policy constraints
  * Fix policy validation when the user policy set is NULL
  * Remove dynamic X509_VERIFY_PARAM registration
  * Const-correct sk_FOO_cmp_func
  * Sort various X.509 global lists sooner
  * Add a warning about OBJ_create and global state
  * Fix parameter name for i2d_X509_EXTENSION
  * Give X509 an ASN1_ITEM again
  * Reject non-minimal lengths in ASN1_get_object
  * Reimplement X509 parsing without templates
  * add bindings to RAND_bytes
  * Represent unknown universal types with V_ASN1_OTHER
  * - remove dependency on hex-literal crate - add helper for converting between hex strings and bytes
  * Rewrite c2i_ASN1_OBJECT
  * Make ASN1_OBJECT_create size_t-clean.
  * Rewrite ASN1_OBJECT and ASN1_BOOLEAN d2i/i2d functions.
  * add bindings for hkdf and update panic handler
  * Get rid of the libc crate dependency in bssl-sys
  * Set up cargo deny to deny new dependencies by default.
  * Reduce type-punning in ASN1_TYPE
  * Add a test for OPTIONAL CHOICE values
  * Add CTRDBG_STATE to bssl::UniquePtr
  * Hmac should be able to take longer keys
  * Const-correct and document a few functions in x509v3.h.
  * Test that X509_NAMEs sort their RDNs when encoding.
  * Tidy up HMAC_Init_ex slightly
  * Rust bindings to boringssl plain AES implementation
  * Rust build cleanup
  * initial setup for bssl crate with hmac and sha2 bindings - update rust folder to split into `bssl` and `bssl-sys` - add initial bindings for hmac and a subset of sha2
  * Add OPENSSL_EXPORT to BN_mod_inverse_blinded
  * Add prefetch to sha1_block_data_order_shaext
  * Remove EVP_PKEY_ASN1_METHOD and EVP_PKEY_METHOD from public headers
  * test_fips: flush stdout before aborting on failure.
  * Work around a NASM bug
  * Plug a leak in ASN1_item_i2d()
  * Add a few more assertions to compiler_test.cc.
  * Fix use of unitialized cbb on failure case.
  * urandom_test: force MADV_WIPEONFORK both ways.
  * Use KEM terminology in TLS ECDHE and key_share abstractions
  * Define a NID for P-384 + Kyber768.
  * Use the common location for CMake in the bots
  * Fix ninja run_tests
  * Workaround yet more NULL + 0 language bugs
  * Fix the generated CMake build
  * Replace almost all instances of CMAKE_SOURCE_DIR and CMAKE_BINARY_DIR
  * Ignore elf.ErrNoSymbols in util/read_symbols.go
  * Run Go tests as part of run_tests
  * Pick up a VS 2022 toolchain from Chromium
  * Switch to CIPD's copy of perl
  * Simplify ECKeyShare slightly.
  * Move the ASN.1-based SSLKeyShare serialization to handoff.cc.
  * Create the SSLKeyShare object in TLS 1.2 client ECDHE slightly later
  * Require getauxval on 32-bit Arm Linux
  * Go back to breaking syscalls with the syscall number
  * Pass the full user_regs_struct to PTRACE_SETREGS
  * Print the reason the child stopped in urandom_test
  * Move data from .text to .rodata on x86_64
  * Start a Kyber implementation with basic Keccak code.
  * Tweak urandom_test for Android devices without getrandom.
  * Cap the number of ECDSA and DSA sign iterations.
  * Add more DSA consistency checks.
  * Revert "Revert "Fetch entropy from a system daemon in FIPS mode on Android.""
  * Reject zero ECDSA keys in EC_KEY_set_private_key
  * Gracefully handle DSA objects with missing fields
  * Fix Android tests with new recipe changes
  * acvp: update test expectations
  * acvp: write updated tests without `.bz2` suffix
  * acvp: fix tests
  * Update Go dependencies
  * Move constants from .text to .rodata on aarch64
  * Add bbe@ to list of reviewers
  * Revert go:build ignore lines
  * Replace the union inside EVP_PKEY with void*.
  * Make EVP_PKEY opaque.
  * Make boringssl_gtest_main a STATIC library
  * Update build tools
  * Use --allowlist-file in bssl-sys
  * Tidy up check_chain_extensions after proxy certificate removal
  * Remove proxy certificate support.
  * Remove global_target from build.
  * Don't include custom builds of libc++ in CMake installs
  * Specify -Iinclude with the crypto target.
  * Unify the two copies of bn_add_words and bn_sub_words
  * Implement P256_XMD:SHA-256_SSWU_RO_ and P384_XMD:SHA-384_SSWU_RO_
  * Align the hash-to-curve formulation with draft-16.
  * Fix a -Wignored-qualifiers warning in trust_token_test.cc
  * Make OPENSSL_malloc push ERR_R_MALLOC_FAILURE on failure.
  * Cap decimal input sizes in s2i_ASN1_INTEGER
  * Make ERR and thread use system malloc.
  * Add OPENSSL_asprintf and friends for asprintf(3) functionality.
  * Add a note in INCORPORATING about which branch to use
  * Generate Rust wrappers for HKDF
  * Bound the overall output size of ASN1_generate_v3
  * VMS? I don't think so. Take this for a walk behind the barn.
  * Revert "Drop HRSS assembly."
  * Move Go CMake support into its own file.
  * Get rid of time_t usage internally, change to int64_t
  * Remove d2i_FOO object reuse
  * Don't use negative values for unimplemented modes
  * Don't use object reuse in X509_parse_from_buffer.
  * Remove stale TODO in util/bot/DEPS
  * Remove if'd-out OCB-AES assembly
  * Trim unnecessary -lrt and ws2_32 deps in the build.
  * Unexport GENERAL_NAME_cmp
  * Also test i2d_GENERAL_NAME in X509Test.GeneralName
  * Fix the type of x400Address in GENERAL_NAME
  * Remove old clang-cl workaround
  * Limit the CMake -isysroot assembly workaround to older CMake
  * Clean up test_support_lib and GTest dependencies slightly.
  * Fix various malloc failure paths.
  * Partially mitigate quadratic-time malloc tests in unit tests
  * Add ABI tests for bn_add_words, etc.
  * Avoid branches in GCC in bn/generic.c.
  * Add bn_add_words and bn_sub_words assembly for aarch64.
  * Rearrange bn/generic.c
  * Reject even moduli in RSA_check_key.
  * Move malloc failure testing into OPENSSL_malloc
  * Const-correct the various EVP_PKEY PEM writers
  * Fix leak in set_dist_point_name error handling.
  * Fix leak in error-handling for issuingDistributionPoint
  * Clear false positives in RSA-OAEP constant time validation
  * Fix some clang-format formatting.
  * Stop clang from un-constant-timing copy_from_prebuf.
  * Clear various false positives in RSA constant-time validation
  * Silence an uninitialized variable false positive in GCC.
  * Fix leak on error in v2i_POLICY_MAPPINGS
  * Cap bit indices in the unsafe string-based X.509 extensions API
  * Move OpenSSLConfig.cmake into the cmake/ directory
  * Align header guard style in the remaining headers.
  * Add locale independent implementations of isalpha, isalnum, isdigit, and isxdigit.
  * Fix OPENSSL_NO_ASM builds with the generated CMake build.
  * Remove ASN1_TFLG_COMBINE.
  * Unexport and remove support for implicit tagging on ASN1_ITYPE_EXTERN.
  * Correctly handle optional ASN1_ITEM_TEMPLATE types.
  * Remove the last of the broken NEON workaround
  * Make X509V3_get_value_int free the old value before overwriting it.
  * Fix leak on invalid input to a2i_GENERAL_NAME.
  * Define BORINGSSL_IMPLEMENTATION in the Bazel build
  * Simplify the external Bazel build.
  * Simplify a pair of Go range expressions
  * Fix stray */s in // line comment license headers
  * Mark standalone Go scripts with go:build ignore
  * Align the generated CMake build with the main one.
  * Check for null value in set_dist_point_name.
  * Fix error-handling in X509V3_EXT_add_nconf_sk and X509v3_add_ext.
  * Remove now unnecessary check in CBS_peek_asn1_tag.
  * Introduce a locale-independent version of isdigit
  * Add a fuzzer for the config file machinery.
  * Rewrite ASN1_generate_v3.
  * Add some tests for optional and default ASN1_BOOLEAN.
  * Introduce constants for ASN1_BOOLEAN
  * Introduce a locale-independent version of isspace
  * Add tests for X509_NAME_hash and X509_NAME_hash_old.
  * Remove old Trust Token redeem API.
  * Remove support for ppc64le.
  * Switch ERR_GET_* to inline functions
  * Remove ppc64le assembly.
  * Remove ppc64le delocate and FIPS build.
  * Add CBS_get_u64_decimal.
  * Align ppc assembly setup with other architectures
  * Use the same Deleter across all bssl::UniquePtr<T>.
  * Set C11 in all compilers.
  * Reduce architecture detection in CMake.
  * Work around nasm bug with empty assembly files
  * Also remove poly_rq_mul.S from generate_build_files.py
  * Don't send two post-quantum initial key shares.
  * Drop HRSS assembly.
  * Add a WORKSPACE.toplevel file
  * Unexport BN_MONT_CTX_set_locked.
  * Align headers in generate_build_files.py output.
  * Maintain a frame pointer in aesni-gcm-x86_64.pl and add SEH unwind codes
  * Don't automatically sync the two CONF parameters in X509V3_EXT_nconf.
  * Convert ghash-x86_64.pl to new directives.
  * Add initial support for SEH directives in x86_64 perlasm
  * Fix inhibitPolicyMapping in the new policy tree code.
  * Rewrite X.509 policy tree logic.
  * Don't test for PMULL when NO_ASM.
  * Indent DB lines in x86_64 NASM output.
  * Reduce caller requirements on X509V3_CTX.
  * Rename CTX_TEST to X509V3_CTX_TEST.
  * Handle errors more normally in asn1_gen.c.
  * Fix crash if '@section' is used with no CONF.
  * Test requireAnyPolicy being a SkipCerts value
  * Test policy mappings from invalid policies.
  * Add stubs for hybrid Kyber768 with X25519 or P-256.
  * Add optimised Aarch64 GCM.
  * Test that policy checking always succeeds with just a trust anchor
  * Remove no-op entries from asn1_str2tag.
  * Const-correct sk_FOO_deep_copy's copy callback.
  * Deprecate, test, and document X.509 config APIs.
  * Remove the last of the filename comments.
  * Further const-correct config-based extension creation.
  * Empty stacks are vacuously sorted
  * Add sk_FOO_delete_if.
  * Add over_message issuance and redemption to Trust Tokens.
  * Remove hmac.h include from ssl.h.
  * Simplify MSVC warning configuration
  * Build rust bindings against header files under current source dir
  * Drop the preference for 256-bit ciphers with CECPQ2.
  * Remove custom CONF methods from X509V3_CTX.
  * Unexport various X509V3_CTX and NCONF helper functions.
  * Reword hardware support for AES-GCM.
  * Add a link for FIPS cert #4409.
  * [clang-warning] Don't pass -stdlib=libc++ on Apple platforms
  * Use -pthread instead of -lpthread in Bazel.
  * Add some tests for policy mapping.
  * Add some tests for anyPolicy.
  * Fix some memory leaks in policy_cache_new.
  * Add prefetch to aesni_ctr32_ghash_6x
  * Add tests for rejecting duplicate policy OIDs.
  * Fuzz x509v3_cache_extensions.
  * Fix handling of EXFLAG_INVALID_POLICY on the leaf.
  * Restore ASN1_TIME_set_string's behavior on NULL.
  * Fix return value on malloc failure in tree_calculate_user_set.
  * Const-correct and simplify X509_VERIFY_PARAM_set1_policies.
  * Add a basic threading test for X509 verification.
  * Explicitly warn about streaming AEADs with EVP_CIPHER_CTX.
  * acvptool: add support for uploading results.
  * acvptool: factor out getResultsWithRetry
  * acvptool: factor out logic for connecting to the server
  * Switch X509 ex_* flags to uint32_t.
  * Rename and tidy up x509v3_name_cmp.
  * Fix some more implicit size_t truncations.
  * acvptool: factor out uploadResult
  * Unexport X509V3_NAME_from_section and fix the type of chtype.
  * Finish porting dh_test.cc and ripemd_test.cc to GTest.
  * Replace comment with static assert.
  * Add a tool to check whether a binary has an executable stack
  * Disable blinding for boringssl_self_test_rsa().
  * Drop the workaround for the third-party Android CMake toolchain.
  * Fully condition all assembly files.
  * See whether relative links work for the documentation.
  * Add SSL_was_key_usage_invalid.
  * Add an 'all' option to generate_build_files.py
  * delocate: match all the ARM register extension patterns.
  * Fix -Wshorten-64-to-32 errors in ex_data.c.
  * acvptool: KDA replaces KAS-KDF for HKDF.
  * Add NO_CHECK_TIME to SSLTest.ECHBuiltinVerifier too
  * Rewrite i2o_ECPublicKey with CBB_finish_i2d.
  * Fix timebomb by disabling time check in this test
  * [Bazel] Support More Platforms
  * Add int casts to BIO_ctrl calls where appropriate.
  * Switch microsecond and iteration counts in bssl speed to uint64_t.
  * Finish porting dsa_test.cc to GTest.
  * Remove unnecessary L suffixes on DES constants.
  * Fix up some integer types in crypto/asn1
  * Use a sized type for asn1t.h flags.
  * Don't allow the caller to configure invalid signature algorithms.
  * Never accidentally use SSL_SIGN_RSA_PKCS1_MD5_SHA1 at TLS 1.2.
  * Add a copy of ninja from CIPD to util/bot/DEPS
  * Include ctrdrbg.h in the Rust wrapper.
  * Test, re-document, and deprecate EVP_Cipher.
  * Test streaming the AAD into EVP_CIPHER_CTX.
  * Add negative tests for the EVP_CIPHER tag check.
  * Test the most likely point for calling EVP_CIPHER_CTX_copy.
  * Give cipher tests a common entrypoint.
  * Correct the maximum output size in cipher_test.cc
  * Tidy up cipher_test.cc slightly
  * Cap Montgomery moduli to 8 KiB.
  * Fix allocation size in BN_mod_exp_mont_consttime.
  * delocate: learn about more Aarch64 registers.
  * Preprocess asm on all platforms with delocate.
  * Add a note in bn.h that this is not for general-purpose math.
  * Minor style tweaks in BN_mod_exp_mont_consttime.
  * Bump Go version in go.mod and run go mod tidy.
  * Split bn_tests.txt into several test files.
  * Work around some valgrind warnings in GTest.
  * Fix comments now BN_mod_exp_mont_consttime is not cache-line-sensitive
  * Replace MOD_EXP_CTIME_ALIGN with align_pointer.
  * Add a hint to the C++ ending guard message
  * Make OPENSSL_tm_to_posix and OPENSSL_posix_to_tm public API
  * delocate: be able to preprocess inputs.
  * Update x86_64-mont5.pl and RSAZ comments a bit.
  * Update SDE.
  * Update build tools.
  * Bump minimum CMake version.
  * Migrate io/ioutil uses to new APIs.
  * Switch blinding indices to size_t.
  * Remove ASN1_PRINTABLE_type.
  * Replace malloc/memcpy pairs with memdup.
  * Release memory earlier when clearing ASN1_ENCODING.
  * Align the generated gni files with the new Chromium copyright header
  * Define CBS/CBB tags as uint32_t with a typedef.
  * More -Wshorten-64-to-32 fixes.
  * Introduce ossl_ssize_t and use it in ASN1_STRING_set.
  * Do not allow changing keys with parameters already set.
  * Fix the comment in ecp_nistz256_ord_sqr_mont to match code and prototype.
  * Allow EVP_PKEY_copy_parameters into an untyped EVP_PKEY.
  * Fix integer overflow in OPENSSL_gmtime_adj
  * Check for overflow in i2c_ASN1_BIT_STRING.
  * Add the suite of EC_KEY and EC_POINT serializers.
  * Skip the field inversion when just measuring output size.
  * Allow using the TLS exporter in more cases.
  * Print the curve name, not bit length in EVP_PKEY_print_*
  * Remove tautological comparison.
  * Fix EC public key output in EVP_PKEY_print_*
  * Add missing heading to DSA output.
  * Fix trailing whitespace in EVP_PKEY_print_*
  * Revert "Default SSL_set_enforce_rsa_key_usage to enabled."
  * Simplify crypto/evp/print.c.
  * Add tests for EVP_PKEY_print_*
  * Clean up short BIGNUM handling in bn_print.
  * Miscellaneous -Wshorten-64-to-32 fixes.
  * Make EVP_PKEY_*_tls_encodedpoint work with EVP_PKEY_EC.
  * Fix linking with non-MSVC toolchain in Windows platform
  * Break FIPS tests by zeroing out the entire value.
  * Remove CMake install command for modulewrapper.
  * Enable -Wstring-concatenation and silence warning.
  * Switch RSA_sign to size_t.
  * Further fixups on the new tests.
  * Also detect Armv8.2 SHA-512 extensions on FreeBSD.
  * Fix comments around TBSCertificate cache.
  * Test (and, for CSRs, fix) TBS cache invalidation on signing.
  * Add support for arm/aarch64 on FreeBSD
  * Replace UTF8_putc with cbb_add_utf8.
  * Some CBB_init_fixed simplifications.
  * Make CBB_init_fixed infallible and allocationless.
  * Check for TLS 1.3 in SSL_generate_key_block.
  * acvp: support fetching expected results.
  * Add CBB_add_asn1_[u]int64_with_tag.
  * Make DH opaque.
  * Default SSL_set_enforce_rsa_key_usage to enabled.
  * Test i2d_re_* for CRLs and CSRs too.
  * Add EVP_HPKE_KEM_public_key_len and EVP_HPKE_KEM_private_key_len.
  * Remove the experimental in-place record APIs.
  * Maintain the sequence number as a uint64_t.
  * Add int64 ASN1_INTEGER setters too.
  * Also check for V_ASN1_NEG_INTEGER when checking types.
  * Write a test for CONF_parse_list.
  * Make CONF_parse_list size_t-clean.
  * Unexport CONF_parse_list.
  * Use Array<uint8_t> in DTLS1_OUTGOING_MESSAGE.
  * Move the DTLS cookie to SSL_HANDSHAKE.
  * Use the new macOS sysctl names when available
  * Various -Wshorten-64-to-32 fixes.
  * Document and tidy up X509_find_by_*.
  * Remove unused X509_LOOKUP_by_* functions.
  * Check some ASN1_STRING types in crypto/x509
  * Replace even more ad-hoc bytes/integer conversions.
  * Specify all library install destinations
  * Add a poisoned field to EVP_CIPHER_CTX.
  * Stub out DSA paramgen functions.
  * Stub out the OpenSSL secure heap.
  * Define OPENSSL_NO_SSL_TRACE.
  * Add ASN1_INTEGER_get_int64 and ASN1_ENUMERATED_get_int64.
  * Add the "groups" variants of SSL_CTX_set1_curves_list.
  * Provide the other primes from RFC 3526.
  * Silence a GCC 12 -Warray-bounds false positive warning.
  * Rework truncated SHA-2 to silence GCC 12 false positive warning.
  * Require getrandom in all FIPS builds.
  * Incorporate OS entropy on FIPS CTR-DRBG reseed, not just init.
  * Add RAND_get_system_entropy_for_custom_prng
  * Rewrite RSA_verify_PKCS1_PSS_mgf1 with size_t.
  * Check set_encrypt_key return value in AESTest.ABI.
  * Prefer established session properties mid renegotiation.
  * Add EVP_HPKE_KDF_hkdf_md.
  * Find threading library
  * Use O_CLOEXEC instead of fcntl(FD_CLOEXEC)
  * Add an EVP_HPKE_KEM_enc_len API.
  * Track SSL_ERROR_ZERO_RETURN explicitly.
  * Clean up header to reuse __riscv definition
  * Tighten up supported PSS combinations in X.509.
  * Add HMAC_CTX_get_md.
  * Add a test for SSL_CTX_set_quiet_shutdown.
  * Add X509_STORE_CTX_set0_trusted_stack.
  * Add X509_V_FLAG_NO_CHECK_TIME.
  * Add DSA_bits and DH_bits.
  * Add handshake hints for TLS 1.2 session tickets.
  * Rework STACK_OF(T) documentation.
  * Fix some typos in comments.
  * Remove stale comment.
  * Fix SSL_load_client_CA_file when given an empty file.
  * Define NR_getrandom for riscv64
  * Adapt break-tests.sh to run on an attached Android device.
  * Include hopefully all ARM instructions with condition codes.
  * Replace OPENSSL_STATIC_ASSERT with static_assert.
  * Make time_t conversions. Give up on the OS provided ones.
  * Test that close_notify state does not impair SSL_ERROR_SYSCALL.
  * Convert more of the SSL write path to size_t and Spans.
  * Revert "Fetch entropy from a system daemon in FIPS mode on Android."
  * Fetch entropy from a system daemon in FIPS mode on Android.
  * Merge entropy read in FIPS mode.
  * Rename |from_cpu| to |want_additional_input|.
  * Support handshake hints for TLS 1.2 full handshakes.
  * Expose the CTR_DRBG API.
  * Don't try and test 3DES with ACVP.
  * Fix possible ODR violations for ecp_nistz256_from_mont
  * Don't try to specify SHA-256 for Aarch64 FIPS.
  * Fix up book-keeping between the write buffer and pending writes.
  * Fix an edge case in SSL_write's retry mechanism.
  * Fix unused variable warning on macOS + ASan
  * Remove PEM_X509_INFO_write_bio.
  * Add SSL_CTX_get_num_tickets.
  * Mostly Revert 52426 - Drop AVCP support for 3DES
  * Add script to run FIPS break tests.
  * More alignment with OpenSSL on TLS 1.3 cipher suite constants.
  * Align with OpenSSL on TLS 1.3 cipher suite constants.
  * Document and organize some of the basic extensions functions.
  * Const-correct X509_EXTENSION functions, as best we can.
  * Document all the dup functions.
  * Const-correct X509_REVOKED as well.
  * Const-correct and document EVP_PKCS82PKEY and EVP_PKEY2PKCS8.
  * Remove PKCS8_pkey_get0 and PKCS8_pkey_set0.
  * Move all the miscelleneous convenience functions into a section.
  * Fix the documentation of X509_pubkey_digest.
  * Remove the last of the Suite B code.
  * Remove X509_ocspid_print.
  * Unexport all low-level policy machinery.
  * Document most X509_NAME functions.
  * Add some tests for X509_NAME_ENTRY management.
  * Clarify thisUpdate vs. lastUpdate in docs.
  * Start grouping x509.h into sections.
  * Start expanding DECLARE_ASN1_* macros in x509.h.
  * Bump CMake requirement to 3.8.
  * Remove X509_ALGORS.
  * Remove X509_REQ's refcount.
  * Const-correct the i2d/dup functions we can.
  * Use GTest's built-in sharding feature
  * Fix memory leak with X509V3_ADD_DELETE.
  * Tidy up ASN1_GENERALIZEDTIME_adj and ASN1_UTCTIME_adj.
  * Check for invalid UCS-2 and UTF-32 in ASN1_STRING_print_ex.
  * Check Unicode string encodings in crypto/asn1.
  * Rewrite scalar operations in spake25519.c with BN_ULONG
  * Accept invalid "v3" CSRs.
  * Drop stdout when looking for abort messages
  * Add a CCM AEAD for Matter, the IoT standard.
  * Remove some unnecessary NULL checks.
  * Reimplement ASN1_TIME_print with the new parser.
  * Dedup a few more load/store implementations.
  * Remove a few more unions.
  * Remove p256_point_union_t.
  * Don't use a union in Ed25519 EVP_PKEYs.
  * Set is_first and is_last correctly with ASN1_STRFLGS_UTF8_CONVERT.
  * Remove unnecessary parens on return.
  * Post-clang-format fixups.
  * Run convert_comments.go on the recently-converted files
  * Re-run clang-format with InsertBraces.
  * clang-format remaining directories.
  * Add fixed key generation for Trust Token.
  * Fix duplicate declarations
  * Validate ASN.1 times according to RFC 5280
  * Define STACK_OF(OPENSSL_STRING) more straight-forwardly.
  * Rewrite SSL_add_file_cert_subjects_to_stack
  * Rearrange the C11 vs MSVC check.
  * Fix build with MSVC 2022.
  * Don't guard alignof static asserts on GCC/Clang.
  * Add BN_GENCB_get_arg.
  * Const-correct bn_gather5.
  * Get the EVP_PKEY_METHOD from EVP_PKEY_ASN1_METHOD.
  * Add SHA3 support
  * More includes for builds that don't use bcm.c
  * Replace some more C unions.
  * Add X509_REQ_set1_signature_algo and X509_REQ_set1_signature_value.
  * Add support for RISC-V 64-bit architecture
  * Add EVP_PKEY_HKDF for OpenSSL compatibility.
  * Make it more obvious that am and tmp's widths are accurate.
  * Add some more includes.
  * Align rsaz and mont5 table construction.
  * Simplify mont5 table computation.
  * Add an extra reduction step to the end of RSAZ.
  * Always end BN_mod_exp_mont_consttime with normal Montgomery reduction.
  * Use // instead of # for comments inside armv8 asm.
  * Add SSL_[CTX_]_set_compliance_policy.
  * Increase ACVP sizes.
  * Add a fuzzer to check CBS is a DER parser.
  * Add some missing includes.
  * Move digestsign.c into the module.
  * Manually fix a few tables in advance of clang-format.
  * Remove leading blank lines in convert_comments.go
  * Rewrite ASN1_STRING_print_ex escaping.
  * Convince clang-format to handle ASN1_ITEM definitions better
  * Do not allow md4 or md5 based signatures in X.509 certificates.
  * Fix docs for EVP_Cipher given an AEAD.
  * Remove a layer of indirection from most EVP_CIPHERs
  * Make EVP_CIPHER opaque.
  * Use the correct function types in X509V3_EXT_METHODs.
  * Remove X509_CRL_METHOD.
  * Clean up ECDSA EVP_PKEY_CTRL_MD validation.
  * Add a service indicator for FIPS 140-3.
  * Move cmac into the FIPS module boundary.
  * Use CMake's C/C++ version features.
  * Update build tools.
  * Don't leave stray errors in the error queue in X509_print_ex.
  * Switch to the CIPD version of CMake on Windows.
  * limit the feature macro stuff to __linux__
  * Enforce X.509 version invariants more consistently.
  * Remove X509_to_X509_REQ.
  * Declare EVP_AEAD_CTX in base.h, like other typedefs.
  * Add missing blank line between functions.
  * Remove unions in EC_SCALAR and EC_FELEM.
  * Implement SSL_CTX_set_num_tickets.
  * Add tests for X509_NAME_print_ex.
  * acvp: test CTR-DRBG with reseed in modulewrapper.
  * Do pending `go fmt` updates.
  * acvp: test SHA-512/256 with HMAC, RSA (PSS), and ECDSA.
  * Add PSS to the AVCP regcap.
  * Drop ACVP support for 3DES.
  * Add function to return the name of the FIPS module.
  * Support running tests on non-NEON devices.
  * Update delocate tests
  * Tidy up how ASN1_STRING_print_ex figures out the type.
  * Remove the ASN1_TLC cache. It appears to not help performance.
  * Fix build for older CMake versions.
  * Remove code added to avoid SHA1 weakness.
  * Update comment in light of prior change.
  * ChaCha20-Poly1305 for Armv8 (AArch64)
  * Replace the last strcasecmp with OPENSSL_strcasecmp.
  * [build] Fix build with HEAD clang.
  * Make calls to the verify callback consistant by calling ctx->verify_cb directly. This removes some temporary variables that would only be used to hold ctx->verify_cb.
  * Try to require C11 (in non-MSVC compilers).
  * Try to require C++14.
  * Reject [UNIVERSAL 0] in DER/BER element parsers.
  * Add CMake install rules.
  * P-256 assembly optimisations for Aarch64.
  * hrss: always normalize.
  * Use SHA-256 for the FIPS integrity check everywhere.
  * Remove unused variable
  * Use X509 certificate alias as friendlyName in PKCS12
  * Retire the Windows BIO_printf workaround.
  * Work around another C language bug with empty spans.
  * ASAN replaces malloc and free with its own implementation.
  * Update fiat-crypto.
  * Remove VS 2015 support.
  * Remove X509_TRUST_set_default.
  * Replace internal use sha1 hash with sha256.
  * Document that |EC_KEY_generate_fips| works for both cases.
  * Allow the integrity test to be run on demand.
  * Add a function to return a FIPS version.
  * Add a function to tell if an algorithm is FIPS approved.
  * Add vs2019 to vs_toolchain.py.
  * Unexport X509_CERT_AUX and remove X509_CERT_AUX.other
  * Document and tidy up X509_alias_get0, etc.
  * Don't loop forever in BN_mod_sqrt on invalid inputs.
  * Make a whitespace commit to trigger a build.
  * Rust bindings: Use CARGO_MANIFEST_DIR in build.rs
  * Remove ASN1_ADB_INTEGER.
  * Replace an ASN1_INTEGER_get call with ASN1_INTEGER_get_uint64
  * Correctly handle LONG_MIN in ASN1_INTEGER_get.
  * Implement ASN1_INTEGER_set_uint64 with ASN1_STRING_set.
  * Rewrite and tighten ASN1_INTEGER encoding and decoding.
  * Deduplicate the rest of ASN1_INTEGER and ASN1_ENUMERATED.
  * Fix theoretical overflow in ASN1_INTEGER_cmp.
  * Include rsa/internal.h for |...no_self_test| functions.
  * Limit the pthread_rwlock workaround to glibc.
  * Rewrite ASN1_INTEGER tests.
  * Use X509V3_add_value_int in i2v_AUTHORITY_KEYID.
  * Fix x509v3_bytes_to_hex when passed the empty string.
  * Reimplement ASN1_get_object with CBS.
  * Add an explicit indefinite-length output to CBS_get_any_ber_asn1_element.
  * Use ctype(3) in a more standards-conformant way.
  * Linkify RFCs in more places in the docs.
  * Make FFDH self tests lazy.
  * Make ECC self tests lazy.
  * HPKE is now RFC 9180.
  * Include the policy document for the most recent FIPS validation.
  * Check static CPU capabilities on x86.
  * Align rsaz_avx2_preferred with x86_64-mont5.pl.
  * Enable SHA-NI optimizations for SHA-256.
  * Update Intel SDE.
  * Include the EKU extension in bssl server's self-signed certs.
  * Don't call a non-test file *test.h.
  * Make RSA self-test lazy.
  * Add link to new Android FIPS certificate.
  * delocate: handle a new output form in Clang 13.
  * Drop, now unused, KAT value.
  * Drop CAVP code.
  * Break FIPS tests differently.
  * Don't forget hmac.h in self_check.h.
  * Perform SHA-$x and HMAC KAT before integrity check.
  * Add a couple of spaces to `check_test`.
  * Split FIPS KATs into fast and slow groups.
  * Move DES out of the FIPS module.
  * acvp: don't send the Authorization header when renewing tokens
  * Support Bazel's test-sharding protocol.
  * Simply CMake assembly source selection.
  * Rename generated assembly from 'mac' or 'ios' to 'apple'
  * Build aarch64 assembly for macOS in the bazel build.
  * Fix OPENSSL_NO_ASM definition in bazel.
  * Use @platforms in Bazel rules.
  * Record ClientHelloInner values in msg_callback.
  * Fold ssl_decode_client_hello_inner into ssl_client_hello_decrypt.
  * Explicitly reject self-referential ech_outer_extensions.
  * Simpler square-root computation for Ed25519
  * Condition split handshake tests on Linux in CMake.
  * Implement PEM_read_bio_DHparams with the macro.
  * Limit _XOPEN_SOURCE to Linux.
  * Fix Unicode strings for C++20
  * Switch CRYPTO_BUFFER_POOL to SipHash-2-4.
  * LSC: Apply clang-tidy's modernize-use-bool-literals to boringssl
  * Fix mac_arm64 builder.
  * Put Rust binding generation behind an explicit flag and only build bindings for the targeted Arch
  * Add ARMV8_SHA512 detection for Fuchsia.
  * Generates "low-level" bindings for Rust using bindgen
  * Add note about Gerrit account creation
  * Make EVP_AEAD_CTX_free accept NULL.
  * Zero out the values from the integrity check.
  * Ignore duplicates in |X509_STORE_add_*|
  * Don't #include "internal.h" twice.
  * Version bump: 2 -> 3.
  * Simplify __ARM_ARCH__ definition.
  * Don't use __ARMEL__/__ARMEB__ in aarch64 assembly
  * Switch __ARM_FEATURE_CRYPTO to __ARM_FEATURE_{AES,SHA2}.
  * Move CPU detection symbols to crypto/internal.h.
  * Move public APIs from cpu.h to crypto.h.
  * Rename CPU feature files with underscores.
  * Enable SHA-512 ARM acceleration when available.
  * Sync sha512-armv8.pl up to 753316232243ccbf86b96c1c51ffcb41651d9ad5.
  * Import sha512-armv8.pl transforms from upstream NEON code.
  * Import a few test vectors from OpenSSL.
  * Use uint16_t in TestConfig and enable -Wformat-signedness.
  * Reorder flags to match TestConfig struct.
  * Rewrite bssl_shim command-line parser.
  * Fix X509_CRL_print error-handling.
  * Silence -Wformat-signedness when printing X.509 versions.
  * Don't print small, negative serial numbers in decimal.
  * Fix the easy -Wformat-signedness errors.
  * Add BIO_tell and BIO_seek wrappers.
  * Remove non-standard wildcard input DNS names.
  * Rewrite X.509 name-matching tests.
  * Remove non-standard X.509 DNS wildcard matching.
  * Make X509_REVOKED opaque.
  * Document |SSL_set1_host| return values.
  * Add |SSL_set1_host| and |SSL_set_hostflags|.
  * Add ERR_set_error_data for compatibility.
  * Add BN_GENCB_new, BN_GENCB_free, and RSA_test_flags.
  * Remove X509_REVOKED.sequence.
  * Binary tag bump: 1 -> 2
  * Export PKCS12_DEFAULT_ITER.
  * Add SSL_has_pending.
  * Update HPKE test vectors.
  * Add various OpenSSL compatibility functions.
  * Add PKCS7_bundle_raw_certificates function which takes CRYPTO_BUFFERs
  * No-op change to test the bots.
  * Remove outdated comment in ECDSA implementation.
  * Add missing assert.h include.
  * Check tag class and constructed bit in d2i_ASN1_OBJECT.
  * Don't parse constructed BIT STRINGs in crypto/bytestring
  * Enforce DER rules for BIT STRING values.
  * Remove support for indefinite lengths in crypto/asn1.
  * Remove support for constructed strings in crypto/asn1.
  * Check for trailing data in extensions.
  * Update tools.
  * Fold x509v3/pcy_int.h into x509v3/internal.h.
  * Switch kModuleDigestSize to a macro.
  * Switch DEPS actions on bots to Python 3.
  * Match OPENSSL_EXPORT in ssl/internal.h friend declarations.
  * Add a function to express the desired record version protocol.
  * Add CRYPTO_BUFFER_new_from_static_data_unsafe.
  * Finish documenting asn1.h.
  * Trim some undocumented symbols from asn1.h.
  * Add magic tag to BoringSSL binaries.
  * Document and const-correct multi-string types.
  * Fully unexport X509_VAL.
  * Document ASN1_OBJECT, i2c, and c2i functions.
  * Unexport ASN1_OBJECT_new.
  * Return 0x80 in all ASN1_get_object error paths.
  * Document low-level encoding functions in asn1.h.
  * Use C preprocessor comments in assembly headers.
  * Document and const-correct ASN1_TYPE functions.
  * Fix error-handling for i2a_ASN1_OBJECT.
  * Document i2a_ASN1_* functions.
  * Fold i2a_ASN1_ENUMERATED into i2a_ASN1_INTEGER.
  * Fix BIT STRING comparison in ASN1_STRING_cmp.
  * Rewrite ASN1_item_pack and ASN1_item_unpack.
  * Document some more ASN1_ITEM-associated functions.
  * Reword ASN1_BOOLEAN exception.
  * Move M_ASN1_* to the deprecated section.
  * Fix up some doc.go nits in asn1.h.
  * Document new/free/d2i/i2d for singly-typed ASN1_STRINGs.
  * Document ASN1_NULL.
  * Const-correct the low-level ASN1 i2d functions.
  * Start documenting ASN1_ITEM.
  * Tidy up SSLTest.SetVersion.
  * Deduplicate d2i and i2d documentation.
  * Check tag class and constructed bit in d2i_ASN1_BOOLEAN.
  * Use typedefs in i2d and d2i_ASN1_BOOLEAN.
  * Forward-declare SSL_CLIENT_HELLO.
  * Fix BN_CTX usage in BN_mod_sqrt malloc error paths.
  * Make ASN1_NULL an opaque pointer.
  * Remove remnants of ASN.1 print function generators.
  * Fold x509_vfy.h into x509.h.
  * Make ASN1_STRING_TABLE_add thread-safe and document.
  * Test ASN1_STRING_set_by_NID with custom NIDs.
  * Test ASN1_STRING_set_by_NID with built-in NIDs.
  * Test that built-in ASN1_STRING_TABLEs are sorted.
  * Extract common rotl/rotr functions.
  * Remove X509_STORE_set0_additional_untrusted.
  * Enable X509_V_FLAG_TRUSTED_FIRST by default.
  * Switch x509_test.cc to modify the existing X509_VERIFY_PARAM.
  * Add note to HMAC test vectors from NIST
  * Add log tag for Trusty.
  * Fix CRYPTO_malloc, etc., definitions.
  * Keep EVP_CIPHER/EVP_MD lookup and do_all functions in sync
  * aarch64: Add missing LR validation in 'vpaes_cbc_encrypt'
  * Allow PKCS7_sign to work for signing kernel modules.
  * Speed up constant-time base64 decoding.
  * Unwind remnants of ASN1_TFLG_NDEF.
  * acvptool: add CS3 support.
  * Ignore SIGPIPE in the bssl tool.
  * Add FIPS counters for AES-GCM in EVP_AEAD.
  * Refresh fuzzer corpus for ECH draft-13.
  * Fix the TLS fuzzers for ECH draft-13.
  * Clarify that TLS sessions are not application sessions.
  * Fix BN_prime_checks_for_validation to align with false-positive rate.
  * Add maskHash to RSA_PSS_PARAMS for compat
  * Remove ASN1_OP_I2D_* callbacks.
  * Don't read it->funcs without checking it->itype.
  * Reject missing required fields in i2d functions.
  * Reject -1 types in ASN1_TYPE and MSTRINGs when encoding.
  * Correctly handle invalid ASN1_OBJECTs when encoding.
  * Check for invalid CHOICE selectors in i2d functions.
  * Fix x509_name_ex_i2d error-handling.
  * Correctly propagate errors in i2d functions.
  * acvptool: add hmacDRBG support
  * Check for __TRUSTY__ instead of TRUSTY.
  * Update comment for ECH draft-13.
  * Silence a GCC false positive warning.
  * Switch to the new, simpler WHATWG URL formulation.
  * Revert "Guard use of sdallocx with BORINGSSL_SDALLOCX"
  * Fix calculation of draft-13 ECH confirmation signal.
  * Update to draft-ietf-tls-esni-13.
  * Reword SSL_get0_ech_name_override documentation.
  * Remove SSL_set_verify_result.
  * Make most of crypto/x509 opaque.
  * Remove V_ASN1_APP_CHOOSE.
  * Rewrite ASN1_PRINTABLE_type and add tests.
  * Include SHA512-256 in EVP_get_digestbyname and EVP_MD_do_all.
  * NUL is not printable.
  * Make RSA_check_key more than 2x as fast.
  * Benchmark RSA private key parsing.
  * Work around yet another MSVC 2015 SFINAE bug.
  * Avoid re-hashing the transcript multiple times.
  * Make ssl_parse_extensions a little easier to use.
  * Deduplicate our three ServerHello parsers.
  * Merge in OpenSSL's X.509 corpus.
  * Run X509_print in the certificate fuzzer.
  * Fix some error-handling in i2v functions.
  * Fix typo.
  * OPENSSL_strndup should not return NULL given {NULL, 0}.
  * Rewrite name constraints matching with CBS.
  * Add some tests for name constraints.
  * Fix i2v_GENERAL_NAME to not assume NUL terminated strings
  * Do not rely on ASN1_STRING being NUL-terminated.
  * Add a CBB_add_zeros helper.
  * Linkify RFCs in documentation.
  * Refer to RFCs consistently.
  * runner: Test session IDs over 32 bytes.
  * Process the TLS 1.3 cipher suite in one place.
  * Guard use of sdallocx with BORINGSSL_SDALLOCX
  * Bump minimum GCC version and note impending VS2015 deprecation.
  * Add Span::first() and Span::last().
  * Simplify built-in BIOs slightly.
  * Fix some error returns from SSL_read and SSL_write.
  * Fix negative ENUMERATED values in multi-strings.
  * Add a test for ASN1_mbstring_copy and clean up.
  * Remove ASN1_TFLG_SET_ORDER.
  * Fix ASN1_STRING_print_ex with negative integers.
  * Check i2d_ASN1_TYPE's return value in ASN1_STRING_print_ex.
  * Document ASN.1 printing functions.
  * Move some ASN1 printing functions to crypto/asn1.
  * Move a_strex.c back to asn1, split X509_NAME bits out.
  * Unwind io_ch abstraction in print functions.
  * Implement ASN1_STRING_print_ex_fp, etc., with file BIOs.
  * Remove OPENSSL_NO_FP_API ifdefs.
  * Move X509_ALGOR to x509.h.
  * Unexport BIT_STRING_BITNAME.
  * Unexport ub_* constants.
  * Always use an ASN1_STRING_TABLE global mask of UTF8String.
  * Document ASN1_mbstring_copy.
  * Update ghashv8-armx.pl from upstream.
  * Align with upstream on 'close STDOUT' lines.
  * Avoid double-expanding variables in CMake.
  * Reject years outside 0000-9999 in ASN1_GENERALIZEDTIME_adj.
  * Add some tests for time_t to ASN1_TIME conversions.
  * Remove ASN1_STRING_FLAG_MSTRING.
  * Document another batch of functions.
  * Clarify BIO_new_mum_buf's lifetime rules.
  * generate_ech.cc: include needed headers
  * Don't overread in poly_Rq_mul
  * acvp: recognise another style of JSON.
  * Revert "Revert "Revert "Disable check that X.509 extensions implies v3."""
  * acvp: add HKDF support.
  * Add 'generate-ech' command to bssl tool
  * Don't enable atomics in NO_THREADS configurations.
  * Check strtoul return for overflow error in GetUnsigned()
  * Add convenience functions to malloc EVP_HPKE_CTX and EVP_HPKE_KEY.
  * Document that SSL_PRIVATE_KEY_METHOD should configure signing prefs.
  * Always have CRYPTO_sysrand_for_seed.
  * hrss: use less stack space.
  * Make X509_EXTENSION opaque.
  * Make X509_CRL opaque.
  * Switch another malloc to bssl::Array.
  * Add a pointer alignment helper function.
  * Remove unused field in X509_NAME_ENTRY.
  * Fix sign bit in BN_div if numerator and quotient alias.
  * Handle the server case in SSL_get0_ech_name_override.
  * Remove -2 return value from X509*_get_*_by_NID.
  * Remove X509at_get0_data_by_OBJ.
  * Document a batch of extension-related functions in x509.h.
  * conf: fix getting keys from the default section.
  * conf: don't crash when parsing.
  * Add some OpenSSL compatibility aliases.
  * Make ASN1_OBJECT opaque.
  * Rename asn1_locl.h to internal.h.
  * Update hpke_test.go.
  * Decorate x509v3_a2i_ipadd declaration as its definition.
  * SHA-256 is used on AArch64, even if NO_ASM.
  * swtb is another AArch64 magic tweak.
  * Implement ClientHelloOuter handshakes.
  * runner: Add a convenience function for base64 flags.
  * Reduce bouncing on the cache lock in ssl_update_cache.
  * Only clear not_resumable after the handshake.
  * runner: Test that clients actually use renewed tickets.
  * runner: Clean up test logic.
  * runner: Fix process exit timeout.
  * Remove old ASN.1 SET macros.
  * Document some ASN1_INTEGER and ASN1_ENUMERATED functions.
  * Document ASN1_STRING_to_UTF8.
  * Const-correct ASN1_item_verify a bit more.
  * Compute ASN.1 BIT STRING sizes more consistently.
  * Remove lh_FOO_doall.
  * Prefix internal LHASH functions.
  * Unexport almost all of LHASH.
  * Rename t1_lib.cc to extensions.cc.
  * Prefix and unexport a2i_ipadd.
  * Fix a -Wdeprecated-copy warning.
  * Validate ECH public names.
  * Fold X509_VERIFY_PARAM_ID into X509_VERIFY_PARAM.
  * Make X509_VERIFY_PARAM opaque.
  * Move crypto/x509/vpm_int.h into internal.h.
  * Reformat x509_vfy.h and convert comments.
  * Reland "Add util/fetch_ech_config_list.go"
  * Revert "Add util/fetch_ech_config_list.go"
  * Add util/fetch_ech_config_list.go
  * More reliably report handshake errors through SSL_write.
  * Add an option to permute ClientHello extension order.
  * runner: Check the test name against the protocol being tested.
  * Remove outdated comment in primality testing.
  * Add most of an ECH client implementation.
  * Add a basic API to make ECHConfigs.
  * Make ECH server APIs take EVP_HPKE_KEY.
  * Rename SSL_ECH_SERVER_CONFIG_LIST to SSL_ECH_KEYS.
  * runner: Self-check tests more accurately and earlier.
  * Don't pad the second ClientHello.
  * Fix ext_pre_shared_key_clienthello_length calculation.
  * Tidy up the PSK binder logic.
  * Move the TLS vs DTLS header length adjustment into ssl_add_clienthello_tlsext.
  * Shift some complexity out of ssl_add_clienthello_tlsext.
  * Add a note about extension callback names.
  * Add move support to EVP_MD_CTX.
  * Replace hs->needs_psk_binder with an output parameter.
  * Make add_clienthello callbacks const.
  * Fix documentation typo.
  * Compute the ECH GREASE payload outside of the callbacks.
  * Pick up the GREASE ECH config ID from grease_seed.
  * Initialize grease_seed on construction.
  * Remove the extension init hook.
  * Move key_share computation out of ClientHello callbacks.
  * Release some temporaries outside of ClientHello callbacks.
  * Move the early_data_{offered,reason} logic out of extension callbacks.
  * Implement a handshake hint for certificate compression.
  * runner: Implement ECH server for testing.
  * runner: Parse the status_request extension more strictly.
  * runner: Make echIsInner a boolean.
  * runner: Revise ECHConfig type in preparation for client implementation
  * Fix ECH-Server-RepeatedConfigID test.
  * Add SSL_ech_accepted API and ech_is_required alerts.
  * Reject the ECH extension in TLS 1.2 ServerHello.
  * Move ECH-related APIs to encrypted_client_hello.cc.
  * Const-correct message creation hooks.
  * Remove the Channel ID callback.
  * Manage Channel ID handshake state better.
  * DTLS-SRTP is only defined for DTLS.
  * Remove impossible ssl->s3 null check.
  * fix #415: Perl scripts fail when building from a path with spaces
  * Cite an RFC over 9000 (draft-ietf-quic-tls is now RFC 9001).
  * Add compatibility impl for EVP_PKEY_get0
  * Make md32_common.h single-included and use an unsized helper for SHA-256.
  * Pull HASH_TRANSFORM out of md32_common.h.
  * Ensure name not null in EVP_get_cipherbyname
  * Fix array-parameter warnings
  * Don't copy client's session ID into server's session.
  * Test ECH server with unique and repeated config IDs.
  * Refresh SSL corpora after adding ECH fuzzer mode.
  * Implement fuzzer mode for ECH server.
  * Don't try to write empty early data in the tool.
  * GREASE is now RFC 8701.
  * runner: Reject all zero client and server randoms.
  * Const-correct SSL_get_srtp_profiles.
  * Update the ECH GREASE size selection.
  * fuzz/minimise_corpora.sh: Add shebang and chmod +x
  * Add a missing case to SSL_error_description.
  * Remove draft tokbind implementation.
  * Make X509_REQ and X509_REQ_INFO opaque.
  * Check hs->early_session, not ssl->session, for the early data limit.
  * Fix some includes.
  * Be clearer which signing inputs are digests.
  * Validate RSA public keys more consistently.
  * Add APIs to manually fill in signatures for CRLs.
  * Check for resumption identifiers in SSL_SESSION_is_resumable.
  * Don't use SHA256(ticket) as the signaling session ID for tickets.
  * Simplify renego + resumption handling.
  * Move session ID assignment out of ssl_get_new_session.
  * Fix the ech_accept comment.
  * Export the HPKE implementation.
  * Refer to EVP_HPKE_CTX by a consistent name.
  * Shift the KEM dependency in HPKE up a step.
  * Update ACVP URLs.
  * Add SSL_can_release_private_key.
  * Make X509_SIG and X509_CERT_AUX opaque.
  * acvp: move hash iterations into modulewrapper.
  * Switch HPKE to a three-parameter output buffer.
  * Introduce EVP_HPKE_{AEAD,KDF} types.
  * Don't mark up the first word in a collective comment.
  * Revise the deterministic for_test variant of HPKE's SetupBaseS.
  * Fix a memory leak with d2i_ASN1_OBJECT object reuse.
  * Remove HPKE PSK mode.
  * Remove HKDF-SHA384 and HKDF-SHA512 from HPKE.
  * Correctly order PKCS#7 certificates and CRLs.
  * Implement ECH draft 10 and update HPKE to draft 08.
  * Document expected use of BTI and PAC macros.

-------------------------------------------------------------------
Sat May 30 08:04:19 UTC 2026 - Martin Pluskal <mpluskal@suse.com>

- Drop 0001-Compile-for-RISC-V.patch: it was an orphaned source
  (shipped but unreferenced, tripping the factory-auto check that
  caused the previous decline) and is obsolete anyway -- the
  pinned boringssl snapshot already carries the RISC-V detection
  in include/openssl/base.h
- Spec cleanup: drop obsolete Group tags and use macros for paths

-------------------------------------------------------------------
Mon Mar 31 21:34:00 UTC 2025 - Jeff Kowalczyk <jkowalczyk@suse.com>

- Update to version 0.20210430 tag fips-20210429. This pinned
  version of boringssl is expected by go1.22 and go1.23 when
  building with GOEXPERIMENT=boringcrypto.
  Refs boo#1236000
  * Remove non-deterministic bits from ECDSA ACVP test.
  * Reference the newer ChaCha20-Poly1305 RFC.
  * Use passive entropy collection everywhere.
  * Rename X509V*_VERSION constants.
  * Const-correct ASN1_OBJECT_create.
  * Clarify OBJ_get0_data and OBJ_get_length.
  * avcp: SHA-1 for ECDSA _verification_ is still supported by NIST.
  * A couple of Aarch64 FIPS delocate fixes.
  * Use a placeholder for unknown errors in ERR_*_error_string.
  * Include assembly optimizations in Bazel builds on Linux-aarch64.
  * Remove some BoringSSL-only X509_CINF functions.
  * Document and test X509_ATTRIBUTE creation functions.
  * Revert handshaker fd numbers and make StartProcess more flexible.
  * Remove support for malformed X509_ATTRIBUTEs.
  * Make X509_ATTRIBUTE opaque.
  * acvptool: Fix typo hard-coding the HTTP method.
  * Document a few more x509.h functions.
  * Make X509_PUBKEY opaque.
  * Always encode booleans as DER.
  * Fix issuerUID and subjectUID parsing in the key usage checker.
  * Add experimental handshake hints API.
  * Make our Python scripts Python-3-compatible.
  * Export ssl_client_hello_init for fuzzers.
  * acvp: support GMAC as an algorithm.
  * Record a fuzzing corpus for the ClientHelloInner decoder.
  * Use a consistent plural for 'corpus'.
  * Add util/bot/libFuzzer to .gitignore.
  * acvp: support KAS-ECC-SSC staticUnified mode.
  * Check for invalid ALPN inputs in SSL_(CTX_)set_alpn_protos.
  * Don't duplicate ServerHello construction code.
  * Rearrange key share and early data logic.
  * Only skip early data with HRR when offered.
  * Add ECH server config API to ssl_ctx_api fuzzer
  * Fix ppc64le build.
  * Simplify the Lucky13 mitigation.
  * Add ECH server (draft-ietf-tls-esni-09).
  * runner: Remove unused field
  * runner: Construct finishedHash earlier.
  * Simplify tls_cbc.c slightly.
  * Remove remnants of CBC SHA2 cipher suites.
  * runner: Test different V2ClientHello challenge lengths.
  * runner: Ensure helloBytes is always the same as hello.marshal().
  * runner: Fix ECH confirmation calculation with PSKs in tests.
  * runner: Fix HPKE parameter order.
  * runner: UpdateForHelloRetryRequest cannot fail.
  * runner: Don't use the buffer in TLS 1.3.
  * runner: Don't maintain two copies of the same transcript hash.
  * runner: Remove remnants of SSL 3.0.
  * runner: Fix writeClientHash and writeRecord ordering.
  * runner: Remove CheckTLS13DowngradeRandom.
  * runner: Remove remnants of the separate HelloRetryRequest message.
  * runner: Store a cipherSuite in ClientSessionState.
  * runner: Move writeHash to the finishedHash struct.
  * Fix the spelling of HPKE AEAD constants.
  * Don't reset server callback expectations on new handshake.
  * Fix MockQuicTransport::Flush error handling.
  * Fold ripemd/internal.h into ripemd.c.
  * Move load/store helpers to crypto/internal.h.
  * Make words in crypto/fipsmodule/modes actually words.
  * Handle EINTR more in handshaker.cc.
  * Add a few missing SSL_R_BIO_NOT_SET cases.
  * Fix some unreachable code in the QUIC handshaker driver.
  * Rearrange SSLKeyShare::Serialize.
  * Fix ssl/internal.h sectioning.
  * Remove some now unnecessary test exclusions from split handshakes.
  * Remove tls13-split-handshakes flag.
  * Define HANDSHAKER_SUPPORTED in once place.
  * Tidy up handshaker tester.
  * modulewrapper: add option to print build information.
  * FIPS counters for AES-CTR.
  * Enforce that pre_shared_key must come with psk_key_exchange_modes.
  * Zero out FIPS counters.
  * Remove is_resume field on TestState.
  * Remove OPENSSL_DANGEROUS_RELEASE_PTHREAD_KEY build flag.
  * Add some warnings on how to use OPENSSL_memory_* functions.
  * Use an unsized helper for truncated SHA-512 variants.
  * Fix mismatch between header and implementation of bn_sqr_comba8.
  * Remove GCC 4.8.99 check.
  * Bump minimum CMake version.
  * Automatically enable C11 atomics when available.
  * Make generate_build_files.py python3 compatible.
  * Remove X509_REQ_set_extension_nids and document related functions.
  * Document a few more functions in x509.h.
  * Do not access value.ptr with V_ASN1_BOOLEAN.
  * Add X509_PUBKEY_get0_public_key.
  * Test empty EVP_CIPHER inputs and fix exact memcpy overlap.
  * Revert "Implement rsa_pkcs1_sha256_legacy."
  * Fix unnecessarily direction-specific tests in cipher_tests.txt
  * Refactor HPKE API to include explicit length parameters.
  * Generalize make_errors.go to allow EVP covering multiple directories.
  * Add a Windows no-op impl of BORINGSSL_self_test
  * Only pass -handshaker-path in split handshakes tests.
  * Add RNG support for FreeBSD.
  * Move fips.c into a subdirectory.
  * Implement rsa_pkcs1_sha256_legacy.
  * Better document nullable X.509 getters.
  * runner: Remove redundant -enable-all-curves shim flag.
  * Initialize nonce in PerAEADTest.ABI.
  * Document ASN1_TYPE and related functions.
  * fips: add counters.
  * Align with OpenSSL on constness of static ASN1_OBJECTs.
  * Add -rr-record flag to runner.go.
  * Register NAME_CONSTRAINTS with bssl::UniquePtr.
  * Register POLICY_MAPPING with bssl::UniquePtr.
  * Stub out some more of PKCS7.
  * Remove TODO to reverse the output of PKCS12_parse.
  * Make the X509_VAL structure opaque.
  * Support creating unencrypted PKCS#12 files.
  * Move PKCS#12 samples to embed_test_data.
  * Remove some remnants of TLS 1.3 downgrade carveouts.
  * Remove X509_REQ_to_X509.
  * Fix OPENSSL_EC_* constants and add EC_GROUP_get_asn1_flag
  * RAND_set_rand_method returns int.
  * Check the inner and outer CRL signature algorithms match.
  * Remove block_mask from EVP_CIPHER_CTX.
  * Document a couple more functions in x509.h.
  * Define X509V*_VERSION constants.
  * Handle the default X.509 version explicitly.
  * Compile for RISC-V.
  * Add ECDSA nonce-testing functions.
  * Rearrange ECDSA implementation.
  * Split the FIPS mode PRNG lock in two.
  * Remove legacy vs_toolchain.py environment variable.
  * runner: Rename 'masterSecret' on session objects to plain 'secret'.
  * Test ECDSA signing is non-deterministic.
  * acvp: split ACVP modulewrapper for reuse by Trusty
  * No-op CL to trigger some builds.
  * Use CIPD Go packages.
  * Update CMake on the bots and switch to CIPD where available.
  * Future-proof vs_toolchain.py for VS2019.
  * Revert "Revert "Disable check that X.509 extensions implies v3.""
  * Update Clang and Go on the bots.
  * Check for OBJ_nid2obj failures in X509_ATTRIBUTE_create.
  * Don't overflow the output length in EVP_CipherUpdate calls.
  * Remove X509_issuer_and_serial_hash.
  * Fix Bazel build breakage.
  * Specify VS toolchain by command-line argument.
  * Update Android Bazel build support in BUILD.toplevel.
  * Honor SSL_TLSEXT_ERR_ALERT_FATAL in the ALPN callback.
  * acvp: detect header element in JSON.
  * Align the ARM capability functions.
  * Skip runtime NEON checks if __ARM_NEON is defined.
  * acvp: don't include CMAC-AES in regcap dump.
  * acvp: fix CMAC verify
  * Include bn/internal.h for non-bcm.c builds.
  * Add various function calls to test_fips.
  * Add missing include to self_check.c.
  * Revert "Disable check that X.509 extensions implies v3."
  * Fix TLS13SessionID-TLS13 test.
  * Use ID instead of Id in Go.
  * acvp: move CMAC verification into the module wrapper.
  * Benchmark BORINGSSL_self_test in FIPS mode.
  * Support MOVLPS and MOVHPS in delocate.
  * Add FFDH FIPS self-test.
  * acvp: update to newer FFDH test.
  * Add basic BLAKE2b-256 support.
  * acvp: check that the payloadLen of cipher tests is correct.
  * acvp: update test expectations in light of 8dcdcb39a7
  * Support cross-compiling AArch64 FIPS to Android.
  * acvp: drop 3DES fields from output when unused.
  * acvp: don't advertise SHA-1 RSA signature generation.
  * Fix comments that refer to old draft of HPKE.
  * Define TLSEXT_TYPE_quic_transport_parameters to the old code point for now.
  * Make BN_clear_free a wrapper around BN_free.
  * delocate: support Aarch64
  * Add DH_compute_key_padded.
  * Fix client 0-RTT handling with ALPS.
  * acvp: add XTS support.
  * doc: fix SSL_set0_rbio
  * Add support for the new QUIC TLS extension codepoint
  * delocate: preprocess perlasm output on Aarch64
  * Replace MockQUICTransport tags with record types.
  * Run extension tests at all protocols.
  * Make QUIC tests work with early data.
  * Make QUIC work with -async tests.
  * Fix ALPS state machine in QUIC servers.
  * runner: Allow tokbind without RI/EMS in TLS 1.3.
  * Test that ALPS can be deferred to the ALPN callback.
  * Send ECH acceptance signal from backend server.
  * delocate: handle Aarch64 assembly in parser.
  * Add ASM optimizations for Windows on Arm
  * Use gai_strerrorA on Windows.
  * Optimize suffix building in FileTest::ReadNext().
  * A handful more compatibility functions.
  * Update HPKE to draft-irtf-cfrg-hpke-07.
  * acvp: drop subprocess_test.go
  * Add some OpenSSL-compatibility aliases
  * delocate: eliminate expression from vpaes assembly.
  * delocate: support alternative comment indicators
  * Update third_party/googletest.
  * acvp: add tests
  * Fix chacha20_poly1305_x86_64.pl comments.
  * Fix awkward wording in comment.
  * Update ECH GREASE to draft-ietf-tls-esni-09
  * Gerrit ignores <sup>; use Unicode superscript instead.
  * acvp: better document the subprocess protocol.
  * Add .text.unlikely.* pattern to fips_shared.lds.
  * acvp: fix silly errors.
  * acvp: load config later.
  * Allow some non-minimal lengths in BER.
  * Export tool_sources to GN.
  * Use more efficient std::string::find overload.
  * Revert "Add support for the new QUIC TLS extension codepoint"
  * Move DH parameter generation out of the FIPS module.
  * Add support for the new QUIC TLS extension codepoint
  * Use stdlib.h instead of cstdlib in span.h.
  * Check for trailing data in X509Test.GeneralName.
  * Fix ChaCha20-Poly1305 x86-64 asm on Windows
  * Include bn.h from bn/internal.h
  * acvp: add support for finite-field Diffie–Hellman.
  * Move DH code into the FIPS module.
  * Remove unused Netware codepaths in x86 perlasm.
  * Finish switching to NASM.
  * Switch to passive entropy collection for Android FIPS.
  * Skip ASN.1 template tests in Windows shared library builds.
  * Add TLS_KDF to documented break tests.
  * acvp: add support for KAS
  * Align armv8.pl references to OPENSSL_armcap_P.
  * Reject bad ASN.1 templates with implicitly-tagged CHOICEs.
  * Implement GREASE for ECH (draft-ietf-tls-esni-08).
  * acvp: add TLS KDF support
  * acvp: tweak config
  * acvp: fix subprocess_test.go
  * Const-correct GENERAL_NAME_cmp.
  * Fix EDIPartyName parsing and GENERAL_NAME_cmp.
  * PWCT failures should clear the generated key.
  * Get closer to Ed25519 boundary conditions.
  * draft-ietf-tls-certificate-compression is now RFC 8879.
  * Update FIPS.md to include latest FIPS certificate.
  * Only accept little-endian ARM and MIPS variants in base.h.
  * aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode
  * Improve sk_dup.
  * Poly1305: Use |size_t|; assert |poly1305_state| is large enough.
  * util/fipstools/acvp/acvptool: buffer signal channel to avoid losing signal
  * Add digest.h to self_check.c
  * Document ASN1_STRING.
  * acvp: add SHA-512/256 support.
  * Add FIPS self test for the TLS KDF.
  * Rename the master_key field in SSL_SESSION to secret.
  * Always check the TLS 1.3 downgrade signal.
  * Fix NETSCAPE_SPKI_get_pubkey documentation.
  * Const-correct and document more X509 functions.
  * Add APIs for checking ASN.1 INTEGERs.
  * Remove some unnecessary pointer casts.
  * Document the basic ASN1_STRING functions.
  * Document some defaults for the EVP RSA interface.
  * Rearrange ASN1_STRING_copy slightly.
  * Remove the legacy MSTRING M_ASN1 macros.
  * Switch M_ASN1_TIME macros within the library.
  * Unwind M_ASN1_* macros for primitive types.
  * Reformat and convert comments in asn1.h.
  * aarch64: Fix name of gnu property note section
  * Re-reformat x509.h.
  * Document X509V3_add1_i2d and friends.
  * Remove ASN1_STRING_FLAG_NDEF.
  * Unexport internal crypto/asn1 functions.
  * Unwind some old ASN.1 ifdefs.
  * Unwind ASN1_PRIMITIVE_FUNCS.
  * Remove some unused types from asn1t.h.
  * Unwind ASN1_TFLG_NDEF.
  * Unwind ASN1_ITYPE_COMPAT.
  * Unwind ASN1_AFLG_BROKEN.
  * Const-correct various X509 string parameters.
  * Document the next few functions in x509.h
  * Remove sk_new_null call.
  * acvp: move inner MCT loops into subprocess.
  * Fix x509_rsa_ctx_to_pss when saltlen is md_size.
  * Document the X509V3_get_d2i family of functions.
  * runner: explicitly signal error from handshaker.
  * runner: add -skip
  * Add functions for manipulating X.509 TBS structures.
  * Remove ASN1_STRING_length_set prototype.
  * Update Go on the bots.
  * Rework vs_toolchain.py and vs_env.py.
  * Add ECDSA verify KAT to FIPS self-tests.
  * Add AES-GCM AEADs with internal nonce generation.
  * Define a constant for the standard GCM nonce length.
  * Add test for X25519-containing certificate.
  * Add SSL_early_data_reason_string.
  * Add raw redeem API.
  * aarch64: Remove some flavour conditionals
  * Have fewer opaque booleans in aead_test.cc
  * acvp: RSA signature verification tests.
  * acvp: RSA signature generation tests.
  * acvp: support RSA key generation tests.
  * Support 4096-bit keys in FIPS mode.
  * Reland "Check AlgorithmIdentifier parameters for RSA and ECDSA signatures.""
  * acvp: add 3DES-CBC support
  * acvp: add 3DES-ECB support
  * Clear some reported gcc -Wshadow warnings.
  * Const-correct X509V3_extensions_print.
  * clang-format and convert comments in x509v3.h.
  * aarch64: Improve conditional compilation
  * Silence some linter checks.
  * acvp: update subprocess_test.go
  * Update clang.
  * Implement draft-vvv-tls-alps-01.
  * Simplify 0-RTT tests.
  * Fix crash when flushing an SSL BIO.
  * Document low-level PEM read/write functions.
  * clang-format pem.h and convert comments.
  * Add PSK variants of HPKE setup functions to BoGo.
  * acvp: abstract out MCT iteration functions.
  * Add Go implementation of HPKE draft 05 to runner.
  * runner: Implement a more complete ClientHello consistency check.
  * Update TrustTokenV2 to use VOPRFs and assemble RR.
  * acvp: add AES-CCM support.
  * acvp: highlight that the TOTP secret goes in the config file.
  * acvp: handle more private key formats.
  * runner: Refactor BoGo clientHelloMsg extension marshalling.
  * Include rodata subsections in FIPS-shared build.
  * Switch x509_test.cc to use C++ raw string literals.
  * Fix some malloc error handling.
  * acvp: add AES-KWP support.
  * acvp: add AES-KW support.
  * acvp: support saving vectors.
  * Fix handling of quic_early_data_context.
  * Add a warning to des.h.
  * Move Trusty workaround to the OPENSSL_LINUX define.
  * acvp: add AES-GCM support.
  * Disable fork detection on Trusty.
  * acvp: add AES-CTR support.
  * Tell clang-format that STACK_OF and LHASH_OF are types.
  * modulewrapper: fix unknown functions.
  * Print SSL_get_error in bssl_shim.
  * modulewrapper: fix sending empty spans.
  * Allow specifying different initial and resumption expectations.
  * Add a few more OPENSSL_NO_* constants.
  * Test SSL_get0_alpn_selected on both client and server.
  * runner: Rewrite sessionState parsing with byteReader.
  * Switch ssl_parse_extensions to bool and Span.
  * Disable check that X.509 extensions implies v3.
  * Silence some clang warnings on macOS and iOS CQ bots.
  * Mirror dsa.h's deprecation notice in dh.h.
  * Const-correct X509_get0_extensions.
- Packaging improvements:
  * _service change disabled to manual per osc deprecation warning:
    WARNING: Command 'disabledrun/dr' is obsolete, please convert
    your _service to use 'manual' and then 'manualrun/mr' instead.
  * Vendor Go build-time utility dependences in go.mod, not yet
    using OBS Service Go Modules.
  * Add BuildRequires: golang(API) >= 1.22 to enable Go related
    utilities used in CMake build steps related to FIPS
    mode. Upstream minimum version per go.mod is go1.13.
  * _service add go_modules to vendor pinned dependences in go.mod
  * Use autosetup -a 1 to unpack source and vendored dependencies
  * Rebase 0001-Compile-for-RISC-V.patch
  * Rebase 0002-crypto-Fix-aead_test-build-on-aarch64.patch
  * Rebase 0003-enable-s390x-builds.patch
  * Rebase 0004-fix-alignment-for-ppc64le.patch
  * Rebase 0005-fix-alignment-for-arm.patch
  * Rebase 0006-gcc-disable-werror.patch
  * Rebase 0007-fix-go-vendor-embed_test_data.patch
  * Rebase 0008-fix-go-vendor-err_data_generate.patch
  * Rebase 0009-soname-sover.patch (was soname-sover.patch)
  * rpmlint fix version-control-internal-file error
  * rpmlint fix script-without-shebang error
  * rpmlint fix non-executable-script error
  * rpmlint fix binary-or-shlib-defines-rpath error use CMAKE_SKIP_RPATH

-------------------------------------------------------------------
Sun Oct 27 20:24:10 UTC 2024 - Fridrich Strba <fstrba@suse.com>

- Change version of the sources to 0.%%cd to avoid problems when
  upgrading if the versioning changes.
- Added patch:
  * soname-sover.patch
    + Replace patchelf run with patch that makes cmake produce the
      shared libraries with the right SONAME and SOVER.
- Remove unnecessary dependencies on go, patchelf, ninja and
  libunwind, since they are only needed for tests we are not
  running

-------------------------------------------------------------------
Fri Feb  9 08:08:42 UTC 2024 - Otto Hollmann <otto.hollmann@suse.com>

- Replace python with python3 (bsc#1219308)

-------------------------------------------------------------------
Wed May  4 10:55:00 UTC 2022 - Andreas Schwab <schwab@suse.de>

- 0001-Compile-for-RISC-V.patch: add support for RISC-V
- enable build on riscv64

-------------------------------------------------------------------
Mon May 17 09:56:04 UTC 2021 - mrostecki@suse.com

- Update to version 20200921 (fixes bsc#1183836, bsc#1181866):
  * Add SSL_CIPHER_get_protocol_id.
  * Add TrustTokenV2.
  * Add X509_get_pathlen and X509_REVOKED_get0_extensions.
  * Add some accommodations for FreeRDP
  * Require non-NULL store in X509_STORE_CTX_init.
  * Const-correct X509V3_CONF_METHOD.
  * Avoid unions in X509_NAME logic.
  * Bump OPENSSL_VERSION_NUMBER to 1.1.1.
  * Document more of x509.h.
  * Fix potential leak in bssl::Array::Shrink.
  * Remove ASN1_STRING_length_set.
  * Revert "Check AlgorithmIdentifier parameters for RSA and ECDSA signatures."
  * Implement PSK variants of HPKE setup functions.
  * acvp: support working with files.
  * Document a few more functions in x509.h.
  * Add subject key ID and authority key ID accessors.
  * Remove sxnet and pkey_usage_period extensions.
  * Const-correct various X509 functions.
  * Make X509_set_not{Before,After} functions rather than macros.
  * Add X509_get0_uids from OpenSSL 1.1.0.
  * Bound RSA and DSA key sizes better.
  * Add set1 versions of X509 timestamp setters.
  * Consistently sort generated build files.
  * delocate: use 64-bit GOT offsets in the large memory model.
  * Update HPKE implementation and test vectors to draft-irtf-cfrg-hpke-05.
  * Handle NULL arguments in some i2d_* functions.
  * aarch64: support BTI and pointer authentication in assembly
  * Support delegated credentials verison 06
  * delocation: large memory model support.
  * Enforce presence of ALPN when QUIC is in use.
  * Fix the naming of alert error codes.
  * Use golang.org/x/crypto in runner.
  * Disable ClientHello padding for QUIC.
  * Add X509_SIG_get0 and X509_SIG_getm.
  * Implement HPKE.
  * Disallow TLS 1.3 compatibility mode in QUIC.
  * Switch clang-format IncludeBlocks to Preserve.
  * Fix unterminated clang-format off.
  * Add line number to doc.go error messages.
  * Kick the bots.
  * Add a JSON output to generate_build_files.py.
  * Add details of 20190808 FIPS certification.
  * Link to ws2_32 more consistently.
  * Allow explicitly-encoded X.509v1 versions for now.
  * Opaquify PKCS8_PRIV_KEY_INFO.
  * Implement i2d_PUBKEY and friends without crypto/asn1.
  * Remove TRUST_TOKEN_experiment_v0.
  * Clarify in-place rules for low-level AES mode functions.
  * acvp: add CMAC-AES support.
  * acvp: add SP800-108 KDF support.
  * Remove x509->name.
  * Maybe build for AArch64 Windows.
  * sha1-x86_64: fix CFI.
  * Use |crypto_word_t| and |size_t| more consistently in ECC scalar recoding.
  * Enable shaext path for sha1.
  * Avoid relying on SSL_get_session's behavior during the handshake.
  * Add a -wait-for-debugger flag to runner.
  * Add missing OPENSSL_EXPORT to X509_get_X509_PUBKEY.
  * Const-correct various functions in crypto/asn1.
  * Remove uneeded switch statement.
  * Convert X.509 accessor macros to proper functions.
  * Remove X509_CINF_get_issuer and X509_CINF_get_extensions.
  * Remove X509_get_signature_type.
  * clang-format x509.h and run comment converter.
  * Check AlgorithmIdentifier parameters for RSA and ECDSA signatures.
  * Remove some unimplemented prototypes.
  * Check the X.509 version when parsing.
  * Fix x509v3_cache_extensions error-handling.
  * Work around Windows command-line limits in embed_test_data.go.
  * Move crypto/x509 test data into its own directory.
  * Test resumability of same, different, and default ticket keys.
  * Fixes warning when redefining PATH_MAX when building with MINGW.
  * Abstract fd operations better in tool.
  * Use CMAKE_SIZEOF_VOID_P instead of CMAKE_CL_64
  * Enforce the keyUsage extension in TLS 1.2 client certs.
  * Reword some comments.
  * Add “Z Computation” KAT.
  * acvptool: handle negative sizeConstraint.
  * Let memory hooks override the size prefix.
  * acvptool: go fmt
  * Assert md_size > 0.
  * Remove -enable-ed25519 compat hack.
  * Add a |SSL_process_tls13_new_session_ticket|.
  * Use ctr32 optimizations for AES_ctr128_encrypt.
  * Test AES mode wrappers.
  * Bump minimum CMake version.
  * Modify how QUIC 0-RTT go/no-go decision is made.
  * Remove RAND_set_urandom_fd.
  * Document that getrandom support must be consistent.
  * Fix docs link for SSL_CTX_load_verify_locations
  * Fix TRUST_TOKEN experiment_v1 SRR map.
  * Add CRYPTO_pre_sandbox_init.
  * Still query getauxval if reading /proc/cpuinfo fails.
  * Add missing header to ec/wnaf.c
  * Fix OPENSSL_TSAN typo.
  * Fix p256-x86_64-table.h indentation.
  * Enable avx2 implementation of sha1.
  * Trim Z coordinates from the OPENSSL_SMALL P-256 tables.
  * Use public multi-scalar mults in Trust Tokens where applicable.
  * Use batched DLEQ proofs for Trust Token.
  * Restrict when 0-RTT will be accepted in QUIC.
  * Disable TLS 1.3 compatibility mode for QUIC.
  * Use a 5-bit comb for some Trust Tokens multiplications.
  * Use a (mostly) constant-time multi-scalar mult for Trust Tokens.
  * Batch inversions in Trust Tokens.
  * Rearrange the DLEQ logic slightly.
  * Use token hash to encode private metadata for Trust Token Experiment V1.
  * Introduce an EC_AFFINE abstraction.
  * Make the fuzzer PRNG thread-safe.
  * Disable fork-detect tests under TSAN.
  * Introduce TRUST_TOKENS_experiment_v1.
  * Route PMBToken calls through TRUST_TOKEN_METHOD.
  * Introduce a TRUST_TOKEN_METHOD hook to select TRUST_TOKEN variations.
  * fork_detect: be robust to qemu.
  * Move serialization of points inside pmbtoken.c.
  * Introduce PMBTOKENS key abstractions.
  * Fix the types used in token counts.
  * Remove unused code from ghash-x86_64.pl.
  * Switch the P-384 hash-to-curve to draft-07.
  * Add hash-to-curve code for P384.
  * Write down the expressions for all the NIST primes.
  * Move fork_detect files into rand/
  * Harden against fork via MADV_WIPEONFORK.
  * Fix typo in comment.
  * Use faster addition chains for P-256 field inversion.
  * Tidy up third_party/fiat.
  * Prefix g_pre_comp in p256.c as well.
  * Add missing curve check to ec_hash_to_scalar_p521_xmd_sha512.
  * Add a tool to compare the output of bssl speed.
  * Benchmark ECDH slightly more accurately.
  * Align remaining Intel copyright notice.
  * Don't retain T in PMBTOKEN_PRETOKEN.
  * Check for trailing data in TRUST_TOKEN_CLIENT_finish_issuance.
  * Properly namespace everything in third_party/fiat/p256.c.
  * Update fiat-crypto.
  * Add missing ERR_LIB_TRUST_TOKEN constants.
  * Add bssl speed support for hashtocurve and trusttoken.
  * Implement DLEQ checks for Trust Token.
  * Fix error-handling in EVP_BytesToKey.
  * Fix Trust Token CBOR.
  * Match parameter names between header and source.
  * Trust Token Implementation.
  * Include mem.h for |CRYPTO_memcmp|
  * acvptool: add subprocess tests.
  * Add SHA-512-256.
  * Make ec_GFp_simple_cmp constant-time.
  * Tidy up CRYPTO_sysrand variants.
  * Do a better job testing EC_POINT_cmp.
  * Follow-up comments to hash_to_scalar.
  * Add a hash_to_scalar variation of P-521's hash_to_field.
  * Add SSL_SESSION_copy_without_early_data.
  * Double-check secret EC point multiplications.
  * Make ec_felem_equal constant-time.
  * Fix hash-to-curve comment.
  * Make ec_GFp_simple_is_on_curve constant-time.
  * Implement draft-irtf-cfrg-hash-to-curve-06.
  * Update list of tested SDE configurations.
  * Only draw from RDRAND for additional_data if it's fast.
  * Generalize bn_from_montgomery_small.
  * Remove BIGNUM from uncompressed coordinate parsing.
  * Add EC_RAW_POINT serialization function.
  * Base EC_FELEM conversions on bytes rather than BIGNUMs.
  * runner: Replace supportsVersions calls with allVersions.
  * Enable QUIC for some perMessageTest runner tests
  * Move BN_nnmod calls out of low-level group_set_curve.
  * Clean up various EC inversion functions.
  * Start to organize ec/internal.h a little.
  * Fix CFI for AVX2 ChaCha20-Poly1305.
  * Remove unused function prototype.
  * Enable more runner tests for QUIC
  * Require QUIC method with Transport Parameters and vice versa
  * acvptool: support non-interactive mode.
  * Add is_quic bit to SSL_SESSION
  * Update SDE.
  * Update tools.
  * Add simpler getters for DH and DSA.
  * Don't define default implementations for weak symbols.
  * Don't automatically run all tests for ABI testing.
  * Fix test build with recent Clang.
  * Remove LCM dependency from RSA_check_key.
  * Simplify bn_sub_part_words.
  * No-op commit to test Windows SDE bots.
  * ABI-test each AEAD.
  * Add memory tracking and sanitization hooks
  * Add X509_STORE_CTX_get0_chain.
  * Add DH_set_length.
  * Static assert that CRYPTO_MUTEX is sufficiently aligned.
  * [bazel] Format toplevel BUILD file with buildifier
  * Add |SSL_CTX_get0_chain|.
  * Configure QUIC secrets inside set_{read,write}_state.
  * Allow setting QUIC transport parameters after parsing the client's
  * Fix comment for |BORINGSSL_self_test|.
  * Trust Token Key Generation.
  * Revise QUIC encryption secret APIs.
  * Fix ec_point_mul_scalar_public's documentation.
  * Don't infinite loop when QUIC tests fail.
  * Tidy up transitions out of 0-RTT keys on the client.
  * Remove bn_sub_part_words assembly.
  * Keep the encryption state and encryption level in sync.
  * Add ECDSA_SIG_get0_r and ECDSA_SIG_get0_s.
  * Fix a couple of comment typos.
  * Const-correct various X509_NAME APIs.
  * Ignore old -enable-ed25519 flag.
  * Provide __NR_getrandom fillins in urandom test too.
  * Skip RSATest.DISABLED_BlindingCacheConcurrency in SDE.
  * Fix client handling of 0-RTT rejects with cipher mismatch.
  * runner: Tidy up 0-RTT support.
  * Add X509_getm_notBefore and X509_getm_notAfter.
  * Clean up TLS 1.3 handback logic.
  * Require handshake flights end at record boundaries.
  * Delete unreachable DTLS check.
  * Rename TLS-specific functions to tls_foo from ssl3_foo.
  * Rename ssl3_choose_cipher.
  * SSL_apply_handback: don't choke on trailing data.
  * ssl_test: test early data with split handshakes.
  * Check for overflow in massive mallocs.
  * Add more convenient RSA getters.
  * Remove SSL_CTX_set_ed25519_enabled.
  * Improve signature algorithm tests.
  * bazel: explicitly load C++ rules
  * Check enum values in handoff.
  * Restore fuzz/cert_corpus.
  * Add a -sigalgs option to bssl client.
  * Add SSL_set_verify_algorithm_prefs.
  * Switch verify sigalg pref functions to SSL_HANDSHAKE.
  * Add SSL_AD_NO_APPLICATION_PROTOCOL
  * Refresh corpora due to TLS 1.3 changes in handoff serialization.
  * handoff: set |enable_early_data| as part of handback.
  * Add 109 and 120 to SSL_alert_desc_string_long
  * runner: enable split handshake tests for TLS 1.3.
  * Make TLS 1.3 split handshakes work with early data.
  * Split half-RTT tickets out into a separate TLS 1.3 state.
  * Use BCryptGenRandom when building as Windows UWP app.

-------------------------------------------------------------------
Thu May 28 11:48:37 UTC 2020 - Jan Engelhardt <jengelh@inai.de>

- Rectify groups.

-------------------------------------------------------------------
Wed May 27 18:40:47 UTC 2020 - Michał Rostecki <mrostecki@suse.com>

- Remove patch for enabling shared linking - it was enabled
  upstream.
  * 0001-add-soversion-option.patch
- Add boringssl-source subpackage.

-------------------------------------------------------------------
Wed May 27 14:18:19 UTC 2020 - mrostecki@suse.com

- Update to version 20200122:
  * Define EVP compatibility constants for X448 and Ed448.
  * Allow shared libraries in the external CMake build.
  * Add a few little-endian functions to CBS/CBB.
  * Move iOS asm tricks up in external CMake build.
  * Try again to deal with expensive tests.
  * Restore ARM CPU variation tests on builders.
  * Remove SSL_CTX_set_rsa_pss_rsae_certs_enabled.
  * Work around another NULL/0 C language bug.
  * Use the MAYBE/DISABLED pattern in RSATest.BlindingCacheConcurrency.
  * Switch an #if-0-gated test to DISABLED_Foo.
  * Proxy: send whole SSL records through the handshaker.
  * Disable Wycheproof primality test cases on non-x86 (too slow)
  * test_state.cc: serialize the test clock.
  * Output after every Wycheproof primality test.
  * Maybe fix generated-CMake build on Android and iOS.
  * Detect the NDK path from CMAKE_TOOLCHAIN_FILE.
  * Tell Go to build for GOOS=android when running on Android.
  * Reland bitsliced aes_nohw implementation.
  * Add bssl client option to load a hashed directory of cacerts.
  * No-op change to run the new NO_SSE2 builders.
  * Clarify that we perform the point-on-curve check.
  * Reduce size of BlindingCacheConcurrency test under TSAN.
  * Compare vpaes/bsaes conversions against a reference implementation.
  * Enable the SSE2 Poly1305 implementation on clang-cl.
  * Remove alignment requirement on CRYPTO_poly1305_finish.
  * Fix double-free under load.
  * Add some XTS tests.
  * Add EncodeHex and DecodeHex functions to test_util.h.
  * Revert "Replace aes_nohw with a bitsliced implementation."
  * Replace aes_nohw with a bitsliced implementation.
  * Switch HRSS inversion algorithm.
  * Run EVP_CIPHER tests in-place.
  * Add an option to disable SSE2 intrinsics for testing.
  * Dummy change to trigger master-with-bazel builder.
  * Drop use of alignas(64) in aead_test.cc
  * Add standalone CMake build to generate_build_files.py
  * TLS 1.3 split handshake initial support.
  * Import Wycheproof primality tests.
  * Split BN_prime_checks into two constants for generation and validation.
  * Add some Miller-Rabin tests from Wycheproof.
  * Import Wycheproof PKCS#1 decrypt tests.
  * Import Wycheproof OAEP tests.
  * Import Wycheproof PKCS#1 signing tests.
  * Skip JWK keys when converting Wycheproof tests.
  * Import Wycheproof's size-specific RSA PKCS#1 verifying tests.
  * Handle "acceptable" Wycheproof inputs unambiguously.
  * Import Wycheproof XChaCha20-Poly1305 tests.
  * Import Wycheproof HMAC tests.
  * Import Wycheproof HKDF tests.
  * bytestring: add methods for int64.
  * Update Wycheproof test vectors.
  * Add mock QUIC transport to runner
  * Add test vectors for CVE-2019-1551 (not affected).
  * Fix check_bn_tests.go.
  * Fix MSan error in SSLTest.Handoff test.
  * SSLTest.Handoff: extend to include a session resumption.
  * inject_hash preserves filemode
  * Move TLS 1.3 state machine constants to internal.h.
  * Add a ppc64le ABI tester.
  * Allocate small TLS read buffers inline.
  * Remove unused labels from ARM ABI test assembly.
  * Update AAPCS and AAPCS64 links.
  * Fix EVP_has_aes_hardware on ppc64le.
  * Remove remnants of end_of_early_data alert from tests.
  * Add a test for ERR_error_string_n.
  * Remove post-quantum experiment signal extension.
  * Give ERR_error_string_n a return value for convenience.
  * Defer early keys to QUIC clients to after certificate reverification.
  * Defer releasing early secrets to QUIC servers.
  * Halve the size of the kNIDsIn* constants
  * modulewrapper: manage buffer with |unique_ptr|.
  * Add missing boringssl_prefix_symbols_asm.h include.
  * acvptool: add support for ECDSA
  * Inline gcm_init_4bit into gcm_init_ssse3.
  * Vectorize gcm_mul32_nohw and replace gcm_gmult_4bit_mmx.
  * Add a constant-time fallback GHASH implementation.
  * Conditionally define PTRACE_O_EXITKILL in urandom_test.cc
  * Fix build warning if _SCL_SECURE_NO_WARNINGS is defined globally
  * modulewrapper: use a raw string.
  * acvptool: add license headers.
  * Enable TLS 1.3 by default.
  * acvptool: Add support for DRBG
  * Discard user_canceled alerts in TLS 1.3.
  * Work around more C language bugs with empty spans.
  * No-op commit to test the new builder.
  * acvptool: Add support for HMAC
  * Add stub functions for RSA-PSS keygen parameters.
  * HelloRetryRequest getter
  * Add break-tests-android.sh script.
  * Add compatibility functions for sigalgs
  * Run AES-192-GCM in CAVP tests.
  * Rename a number of BUF_* functions to OPENSSL_*.
  * List bn_div fuzzer in documentation.
  * Reenable bn_div fuzzer.
  * Drop CECPQ2b code.
  * Add urandom_test to all_tests.json
  * Fix the standalone Android FIPS build.
  * Add sanity checks to FIPS module construction.
  * Correct relative path.
  * Add test for urandom.c
  * break-hash.go: Search ELF dynamic symbols if symbols not found.
  * Fix $OPENSSL_ia32cap handling.
  * Switch probable_prime to rejection sampling.
  * Rename the last remnants of the early_data_info extension.
  * Fix up BN_GENCB_call calls.
  * Do fewer trial divisions for larger RSA keygens.
  * Fix GRND_NONBLOCK flag when calling getrandom.
  * Simplify bn_miller_rabin_iteration slightly.
  * Add some notes on RSA key generation performance.
  * Break early on composites in the primality test.
  * Extract and test the deterministic part of Miller-Rabin.
  * Fix the FIPS + fuzzing build.
  * FIPS.md: document some recent Android changes.
  * Add a function to derive an EC key from some input secret.
  * Fix run_android_tests.go with shared library builds.
  * No-op change to test new builders.
  * Move no-exec-stack sections outside of #ifs.
  * Add |SSL_get_min_proto_version| and |SSL_get_max_proto_version|
  * Make FIPS build work for Android cross-compile.
  * Enable optional GRND_RANDOM flag to be passed to getrandom on Android.
  * Switch cert_compression_algs to GrowableArray.
  * Add GrowableArray<T> to ssl/internal.h.
  * Fixed quic_method lookup in TLS 1.3 server side handshake.
  * Add .note.GNU-stack at the source level.
  * -Wno-vla -> -Wvla
  * Add an option for explicit renegotiations.
  * tool: add -json flag to |speed|
  * Set -Wno-vla.
  * Use a pointer to module_hash in boringssl_fips_self_test() args.
  * Use a smaller hex digest in FIPS flag files when SHA-256 used.
  * Switch to using SHA-256 for FIPS integrity check on Android.
  * Use getentropy on macOS 10.12 and later.
  * Move #include of "internal.h", which defines |OPENSSL_URANDOM|.
  * Style nit.
  * Assert that BN_CTX_end is actually called.
  * Test some known large primes.
  * Test some Euler pseudoprimes.
  * Be consistent about Miller-Rabin vs Rabin-Miller.
  * fix build with armv6  Error: .size expression for _vpaes_decrypt_consts does not evaluate to a constant
  * Mark ssl_early_data_reason_t values stable.
  * Make the dispatch tests opt-in.
  * Bound the number of API calls in ssl_ctx_api.cc.
  * Only attempt to mprotect FIPS module for AArch64.
  * Opportunistically read entropy from the OS in FIPS mode.
  * Update INSTANTIATE_TEST_SUITE_P calls missing first argument.
  * Ignore build32 and build64 subdirectories.
  * Add page protection logic to BCM self test.
  * Disable unwind tests in FIPS mode.
  * Disable RDRAND on AMD family 0x17, models 0x70–0x7f.
  * Don't allow SGC EKUs for server certificates.
  * Add |SSL_CIPHER_get_value| to get the IANA number of a cipher suite.
  * Add XOF compilation compatibility flags
  * Replace BIO_printf with ASN1_STRING_print in GENERAL_NAME_print
  * Trigger a build on the ARM mode builder.
  * Fix vpaes-armv7.pl in ARM mode.
  * Add AES-192-GCM support to EVP_AEAD.
  * Add AES-256 CFB to libdecrepit.
  * Parse explicit EC curves more strictly.
  * Use the Go 1.13 standard library ed25519.
  * Update build tools.
  * Use ScopedEVP_AEAD_CTX in ImplDispatchTest.AEAD_AES_GCM.
  * Use a mix of bsaes and vpaes for CTR on NEON.
  * Use vpaes + conversion to setup CBC decrypt on NEON.
  * Add NEON vpaes-to-bsaes key converters.
  * Add vpaes-armv7.pl and replace non-parallel modes.
  * Correct comments for x86_64 _vpaes_encrypt_core_2x.
  * Add benchmarks for AES block operations.
  * Only write self test flag files if an environment variable is set.
  * Const-correct EC_KEY_set_public_key_affine_coordinates.
  * Revert "Fix VS build when assembler is enabled"
  * Support compilation via emscripten
  * Fix cross-compile of Android on Windows.
  * Move the config->async check into RetryAsync.
  * Clear *out in ReadHandshakeData's empty case.
  * Add initial support for 0-RTT with QUIC.
  * Have some more fun with spans.
  * Add OPENSSL_FALLTHROUGH to a few files.
  * Limit __attribute__ ((fallthrough)) to Clang >= 5.
  * Make |EVP_CIPHER_CTX_reset| return one.
  * Add Fallthru support for clang 10.
  * Add self-test suppression flag file for Android FIPS builds.
  * Align 0-RTT and resumption state machines slightly
  * Require getrandom in Android FIPS builds.
  * acvp: allow passing custom subprocess I/O.
  * Add a function to convert SSL_ERROR_* values to strings.
  * Fold SSL_want constants into SSL_get_error constants.
  * Use spans for the various TLS 1.3 secrets.
  * Switch another low-level function to spans.
  * Switch tls13_enc.cc to spans.
  * Check the second ClientHello's PSK binder on resumption.
  * Introduce libcrypto_bcm_sources for Android.
  * Remove stale TODO.
  * Add an android-cmake option to generate_build_files.py
  * Add a QUIC test for HelloRetryRequest.
  * Add missing ".text" to Windows code for dummy_chacha20_poly1305_asm
  * Update TODO to note that Clang git doesn't have the POWER bug.
  * Fix paths in break-tests.sh.
  * Fix POWER build with OPENSSL_NO_ASM.
  * Workaround Clang bug on POWER.
  * Add assembly support for -fsanitize=hwaddress tagged globals.
  * Fix typo in valgrind constant-time annotations.
  * acvp: add support for AES-ECB and AES-CBC.
  * Fix misspelled TODO.
  * Move CCM fragments out of the FIPS module.
  * Add EVP_PKEY_base_id.
  * Add some project links to README.md.
  * Make alert_dispatch into a bool.
  * Trim some more per-connection memory.
  * Remove SSL_export_early_keying_material.
  * Add EVP_PKEY support for X25519.
  * Make EVP_PKEY_bits return 253 for Ed25519.
  * Make SSL_get_servername work in the early callback.

-------------------------------------------------------------------
Tue Mar 10 20:00:43 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix arm build:
  * 0005-fix-alignment-for-arm.patch

-------------------------------------------------------------------
Wed Dec  4 07:55:10 UTC 2019 - Klaus Kämpf <kkaempf@suse.com>

- fix s390x and ppc64le build
  * 0003-enable-s390x-builds.patch
  * 0004-fix-alignment-for-ppc64le.patch

- rename add-soversion-option.patch
    to 0001-add-soversion-option.patch

- rename 0001-crypto-Fix-aead_test-build-on-aarch64.patch
    to 0002-crypto-Fix-aead_test-build-on-aarch64.patch

-------------------------------------------------------------------
Thu Oct 17 14:54:13 UTC 2019 - Richard Brown <rbrown@suse.com>

- Remove obsolete Groups tag (fate#326485)

-------------------------------------------------------------------
Mon Oct 14 10:40:13 UTC 2019 - Martin Pluskal <mpluskal@suse.com>

- Update to version 20190916:
  * Revert "Fix VS build when assembler is enabled"
  * Only bypass the signature verification itself in fuzzer mode.
  * Move the PQ-experiment signal to SSL_CTX.
  * Name cipher suite tests in runner by IETF names.
  * Align TLS 1.3 cipher suite names with OpenSSL.
  * Prefix all the SIKE symbols.
  * Rename SIKE's params.c.
  * Add post-quantum experiment signal extension.
  * Fix shim error message endings.
  * Add initial draft of ACVP tool.
  * Implements SIKE/p434
  * Add SipHash-2-4.
  * Remove android_tools checkout
  * Support key wrap with padding in CAVP.
  * Add android_sdk checkout
  * Move fipstools/ to util/fipstools/cavp
  * Factor out TLS cipher selection to ssl_choose_tls_cipher.
  * Emit empty signerInfos in PKCS#7 bundles.
  * Clarify language about default SSL_CTX session ticket key behavior.
  * Add an API to record use of delegated credential
  * Fix runner tests with Go 1.13.
  * Add a value barrier to constant-time selects.
  * Avoid leaking intermediate states in point doubling special case.
  * Split p224-64.c multiplication functions in three.
  * Add AES-KWP
  * Discuss the doubling case in windowed Booth representation.
  * Update build tools.
  * Set a minimum CMake version of 3.0.
  * Replace addc64,subc64,mul64 in SIKE Go code with functions from math/bits
  * Eliminate some superfluous conditions in SIKE Go code.
  * Fix various typos.
  * Fix name clash in test structures
  * bcm: don't forget to cleanup HMAC_CTX.
  * Handle fips_shared_support.c getting built in other builds.
  * Fix various mistakes in ec_GFp_nistp_recode_scalar_bits comment.
  * Fix filename in comment.
  * Split EC_METHOD.mul into two operations.
  * Split ec_point_mul_scalar into two operations.
  * Add FIPS shared mode.
  * delocate: add test for .file handling.
  * delocate: translate uleb128 and sleb128 directives
  * Integrate SIKE with TLS key exchange.
  * Convert ecdsa_p224_key.pem to PKCS#8.

-------------------------------------------------------------------
Wed Sep  4 12:15:46 UTC 2019 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Re-enable build on aarch64

-------------------------------------------------------------------
Tue Sep  3 07:15:48 UTC 2019 - Martin Pluskal <mpluskal@suse.com>

- Update to version 20190523:
  * Disable RDRAND on AMD chips before Zen.
  * Always store early data tickets.
  * Align PKCS12_parse closer to OpenSSL.
  * Support PKCS#12 KeyBags.
  * Support PKCS#8 blobs using PBES2 with HMAC-SHA256.
  * Make EVP_PKEY_keygen work for Ed25519.
  * Sync aesp8-ppc.pl with upstream.
  * Update generate_build_files.py for SIKE.
  * Fix the last casts in third_party/sike.
  * Remove no-op casts around tt1.
  * Define p503 with crypto_word_t, not uint64_t.
  * Add support for SIKE/p503 post-quantum KEM
  * tool: fix speed tests.
  * Add an option to skip crypto_test_data.cc in GN too.
  * Save and restore errors when ignoring ssl_send_alert result.
  * Reject obviously invalid DSA parameters during signing.
  * Make expect/expected flag and variable names match.
  * clang-format Flag arrays in test_config.cc.
  * Rename remnants of ticket_early_data_info.
  * Enforce the ticket_age parameter for 0-RTT.
  * Add SSL_get_early_data_reason.
  * Remove implicit -on-resume for -expect-early-data-accept.
  * Use weak symbols only on supported platforms
  * Fix spelling in comments.
  * Add functions for "raw" EVP_PKEY serializations.
  * Remove stray underscores.
  * Add a compatibility EVP_DigestFinalXOF function.
  * Fix up EVP_DigestSign implementation for Ed25519.
  * Check for errors when setting up X509_STORE_CTX.
  * Convert a few more things from int to bool.
  * Compute the delegated credentials length prefix with CBB.
  * Convert the rest of ssl_test to GTest.
  * Check for x18 usage in aarch64 assembly.
  * Handle errors from close in perlasm scripts.
  * Hold off flushing NewSessionTicket until write.
  * Predeclare enums in base.h
  * Require certificates under name constraints use SANs.
  * Make X509_verify_cert_error_string thread-safe.
  * Disable the common name fallback on *any* SAN list.
  * Silently ignore X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT.
  * Add X509_CHECK_FLAG_NEVER_CHECK_SUBJECT.
  * Give ENGINE_free a return value.
  * Output a ClientHello during handoff.
  * Fix and test EVP_PKEY_CTX copying.
  * Test copying an EVP_MD_CTX.
  * Fix EVP_CIPHER_CTX_copy for AES-GCM.
  * Check key sizes in AES_set_*_key.
  * Add missing nonce_len check to aead_aes_gcm_siv_asm_open.
  * Test AES-GCM-SIV with OPENSSL_SMALL.
  * Handle CBB_cleanup on child CBBs more gracefully.
  * Update third_party/googletest.
  * Rename 'md' output parameter to 'out' and add bounds.
  * Update other build tools.
  * Update SDE to 8.35.0-2019-03-11.
  * nit: Update references to draft-ietf-tls-subcerts.
  * Support get versions with get_{min,max}_proto_version for context
  * Update ImplDispatchTest for bsaes-x86_64 removal.
  * Unwind the large_inputs hint in aes_ctr_set_key.
  * Add an optimized x86_64 vpaes ctr128_f and remove bsaes.
  * Add 16384 to the default bssl speed sizes.
  * Rewrite BN_CTX.
  * Save a temporary in BN_mod_exp_mont's w=1 case.
  * Reject long inputs in c2i_ASN1_INTEGER.
  * Harden the lower level parts of crypto/asn1 against overflows.
  * Remove d2i_ASN1_UINTEGER.
  * Drop some unused bsaes to aes_nohw dependencies.
  * Adapt gcm_*_neon to aarch64.
  * Patch out the aes_nohw fallback in bsaes_cbc_encrypt.
  * Patch out the aes_nohw fallback in bsaes_ctr32_encrypt_blocks.
  * Implement sk_find manually.
  * Make vpaes-armv8.pl compatible with XOM.
  * Support three-argument instructions on x86-64.
  * Correct outdated comments
  * Remove SSL_get_structure_sizes.
  * Prefer vpaes over bsaes in AES-GCM-SIV and AES-CCM.
  * Tell ASan about the OPENSSL_malloc prefix.
  * modes/asm/ghash-armv4.pl: address "infixes are deprecated" warnings.
  * Enable vpaes for aarch64, with CTR optimizations.
  * Check in vpaes-armv8.pl from OpenSSL unused and unmodified.
  * silence unused variable warnings when using OPENSSL_clear_free
  * Handle NULL public key in |EC_KEY_set_public_key|.
  * Add a 32-bit SSSE3 GHASH implementation.
  * Also include abi_test.cc in ssl_test_files.
  * Don't pull abi_test.cc into non-GTest targets.
  * Update *_set_cert_cb documentation regarding resumption
  * Add a reference for Linux ARM ABI.
  * Remove __ARM_ARCH__ guard on gcm_*_v8.
  * Fix bsaes-armv7.pl getting disabled by accident.
  * Add an option to configure bssl speed chunk size.
  * Appease GCC's uninitialized value warning.
  * Set VPAES flags in x86-64 code.
  * Enable vpaes for AES_* functions.
  * Avoid double-dispatch with AES_* vs aes_nohw_*.
  * Add uint64_t support in CBS and CBB.
  * Clear out a bunch of -Wextra-semi warnings.
  * Add compiled python files to .gitignore.
  * Fix x86_64-xlate.pl comment regex.
  * Add go 1.11 to go.mod.
  * Remove STRICT_ALIGNMENT code from modes.
  * Remove non-STRICT_ALIGNMENT code from xts.c.
  * Patch XTS out of ARMv7 bsaes too.
  * Remove stray prototype.
  * Always define GHASH.
  * Update delegated credentials to draft-03
  * Use Windows symbol APIs in the unwind tester.
  * Unwind RDRAND functions correctly on Windows.
  * Patch out unused aesni-x86_64 functions.
  * Add ABI tests for aesni-gcm-x86_64.pl.
  * Add ABI tests for x86_64-mont5.pl.
  * sync EVP_get_cipherbyname with EVP_do_all_sorted
  * Hyperlink DOI to preferred resolver
  * Remove stray semicolons.
  * Remove separate default group list for servers.
  * Enable all curves (inc CECPQ2) during fuzzing.
  * Implement ABI testing for aarch64.
  * Fix ABI error in bn_mul_mont on aarch64.
  * Implement ABI testing for ARM.
  * Fix the order of Windows unwind codes.
  * Implement unwind testing for Windows.
  * Tolerate spaces when parsing .type directives.
  * runner: Don't generate an RSA key on startup.
  * Don't use bsaes over vpaes for CTR-DRBG.
  * perlasm/x86_64-xlate.pl: refine symbol recognition in .xdata.
  * Add instructions for debugging on Android with gdb.
  * Enforce key usage for RSA keys in TLS 1.2.
  * Remove infra/config folder in master branch.
  * Avoid SCT/OCSP extensions in SH on {Omit|Empty}Extensions
  * Test and fix an ABI issue with small parameters.
  * Add RSAZ ABI tests.
  * Better document RSAZ and tidy up types.
  * Add ABI testing for 32-bit x86.
  * Add a very roundabout EC keygen API.
  * Add some Node compatibility functions.
  * Implement server support for delegated credentials.
  * Add a constant-time pshufb-based GHASH implementation.
  * Tweak some slightly fragile tests.
  * Make 256-bit ciphers a preference for CECPQ2, not a requirement.
  * Update comments around JDK11 workaround.
  * Add a RelWithAsserts build configuration.
  * Remove union from |SHA512_CTX|.
  * Avoid unwind tests on libc functions.
  * Don't pass NULL,0 to qsort.
  * Fix signed left-shifts in curve25519.c.
  * Add an option to build with UBSan.
  * Fix undefined pointer casts in SHA-512 code.
  * HRSS: flatten sample distribution.
  * Add test of assembly code dispatch.
  * Simplify HRSS mod3 circuits.
  * Add SSL_OP_NO_RENEGOTIATION
  * Rename Fiat include files to end in .h
  * Switch to new fiat pipeline.
  * Don't look for libunwind if cross-compiling.
  * Mark some unmarked array sizes in curve25519.c.
  * Revert "Fix protos_len size in SSL_set_alpn_protos and SSL_CTX_set_alpn_protos"
  * Add ABI tests for GCM.
  * Fix SSL_R_TOO_MUCH_READ_EARLY_DATA.
  * Test CRYPTO_gcm128_tag in gcm_test.cc.
  * Remove pointer cast in P-256 table.
  * Ignore new fields in forthcoming Wycheproof tests.
  * Fix RSAZ's OPENSSL_cleanse.
  * Allow configuring QUIC method per-connection
  * Fix header file for _byteswap_ulong and _byteswap_uint64 from MSVC CRT
  * Add ABI tests for HRSS assembly.
  * Add AES ABI tests.
  * Move aes_nohw, bsaes, and vpaes prototypes to aes/internal.h.
  * Add direction flag checking to CHECK_ABI.
  * Add ABI tests for ChaCha20_ctr32.
  * Add ABI tests for MD5.
  * Refresh fuzzer corpus.
  * Delete the variants/draft code.
  * Update tools.
  * Fix protos_len size in SSL_set_alpn_protos and SSL_CTX_set_alpn_protos
  * Use handshake parameters to decide if cert/key are available
  * Add ABI tests for bn_mul_mont.
  * Add ABI tests for SHA*.
  * Make pkg-config optional.
  * Add DEPS rules to checkout Windows SDE.
  * Add ABI tests for rdrand.
  * Set NIDs for Blowfish and CAST.
  * Add a CFI tester to CHECK_ABI.
  * Fix some size_t to long casts.
  * Add EVP_CIPHER support for Blowfish and CAST to decrepit.
  * Be less clever with CHECK_ABI.
  * Update SDE and add the Windows version.
  * Remove pooling of PRNG state.
  * Add EC_KEY_key2buf for OpenSSL compatibility
  * Remove bundled copy of android-cmake.
  * Clarify build requirements.
  * Add EC_GROUP_order_bits for OpenSSL compatibility
  * Annotate leaf functions with .cfi_{startproc,endproc}
  * Fix beeu_mod_inverse_vartime CFI annotations and preamble.
  * Fix CFI annotations in p256-x86_64-asm.pl.
  * Add a comment about ecp_nistz256_point_add_affine's limitations.
  * Refresh p256-x86_64_tests.txt.
  * Fix some indentation nits.
- Build using ninja
- Update dependencies
- Bump soversion
- Limit building only to supported architectures

-------------------------------------------------------------------
Fri Aug 30 06:52:55 UTC 2019 - Martin Pluskal <mpluskal@suse.com>

- Disable lto to fix build failure

-------------------------------------------------------------------
Thu Apr 25 14:50:41 UTC 2019 - Michał Rostecki <mrostecki@opensuse.org>

- Add patch which fixes build on aarch64.
  * 0001-crypto-Fix-aead_test-build-on-aarch64.patch

-------------------------------------------------------------------
Thu Apr 25 12:41:41 UTC 2019 - dmueller@suse.com

- Update to version 20181228:
  * Use thread-local storage for PRNG states if fork-unsafe buffering is enabled.
  * Add Win64 SEH unwind codes for the ABI test trampoline.
  * Translate .L directives inside .byte too.
  * Add an ABI testing framework.
  * Use same HKDF label as TLS 1.3 for QUIC as per draft-ietf-quic-tls-17
  * Add |SSL_key_update|.
  * HRSS: omit reconstruction of ciphertext.
  * Add start of infrastructure for checking constant-time properties.
  * Don't enable intrinsics on x86 without ABI support.
  * HRSS: be strict about unused bits being zero.
  * Disable AES-GCM-SIV assembly on Windows.
  * Fix typo in AES-GCM-SIV comments.
  * Fix HRSS build error on ARM
  * Fix thread-safety bug in SSL_get_peer_cert_chain.
  * Remove HRSS confirmation hash.
  * Drop NEON assembly for HRSS.
  * Add |SSL_export_traffic_secrets|.
  * Patch out the XTS implementation in bsaes.
  * Remove .file and .loc directives from HRSS ARM asm.
  * Do not allow AES_128_GCM_SHA256 with CECPQ2.
  * Always 16-byte align |poly| elements.
  * Fix bug in HRSS tests.
  * Add initial HRSS support.
  * Forbid empty CertificateRequestsupported_signature_algorithms in TLS 1.2.
  * Eliminate |OPENSSL_ia32cap_P| in C code in the FIPS module.
  * Fix d2i_*_bio on partial reads.
  * Fix |BN_HEX_FMT2|.
  * Remove XOP code from sha512-x86_64.pl.
  * Pretend AMD XOP was never a thing.
  * Drop some explicit SSLKeyShare destructors.
  * Assume hyper-threading-like vulnerabilities are always present.
  * Replace the last CRITICAL_SECTION with SRWLOCK.
  * Validate ClientHellos in tests some more.
  * Re-enable AES-NI on 32-bit x86 too.
  * Make symbol-prefixing work on 32-bit x86.
  * Make Windows symbol-prefixing work.
  * Support Windows-style ar files.
  * Move __.SYMDEF handling to ar.go.
  * Fix stack_test.cc in the prefixed build.
  * Don't double-mangle C++ symbols on macOS.
  * Make read_symbols.go a bit more idiomatic.
  * Unexport and rename hex_to_string, string_to_hex, and name_cmp.
  * Satisfy golint.
  * Add a note that generated files are generated.
  * Work around a JDK 11 TLS 1.3 bug.
  * Move ARM cpuinfo functions to the header.
  * Regenerate obj_dat.h
  * go fmt
  * Support execute-only memory for AArch64 assembly.
  * Remove cacheline striping in copy_from_prebuf.
  * Tidy up type signature of BN_mod_exp_mont_consttime table.
  * No longer set CQ-Verified label on CQ success/failure.
  * Print a message when simulating CPUs.
  * Move JSON test results code into a common module.
  * In 0RTT mode, reverify the server certificate before sending early data.
  * Support assembly building for arm64e architecture.
  * Simulate other ARM CPUs when running tests.
  * Merge P-224 contract into serialisation.
  * Contract P-224 elements before returning them.
  * Add post-handshake support for the QUIC API.
  * Speculatively remove __STDC_*_MACROS.
  * Modernize OPENSSL_COMPILE_ASSERT, part 2.
  * Switch docs to recommending NASM.
  * Mark the |e| argument to |RSA_generate_key_ex| as const.
  * Clean up EC_POINT to byte conversions.
  * Need cpu.h for |OPENSSL_ia32cap_P|.
  * Rename EC_MAX_SCALAR_*.
  * Use EC_RAW_POINT in ECDSA.
  * Optimize EC_GFp_mont_method's cmp_x_coordinate.
  * Optimize EC_GFp_nistp256_method's cmp_x_coordinate.
  * Remove unreachable code.
  * Also accept __ARM_NEON
  * Remove some easy BN_CTXs.
  * Push BIGNUM out of the cmp_x_coordinate interface.
  * Push BIGNUM out of EC_METHOD's affine coordinates hook.
  * Fix r = p-n+epsilon ECDSA tests.
  * Don't include openssl/ec_key.h under extern "C".
  * Abstract hs_buf a little.
  * Inline ec_GFp_simple_group_get_degree.
  * Better test boundary cases of ec_cmp_x_coordinate.
  * Fix build when bcm.c is split up.
  * Revert "Revert "Speed up ECDSA verify on x86-64.""
  * Make SSL_get_current_cipher valid during QUIC callbacks.
  * Devirtualize ec_simple_{add,dbl}.
  * Refresh fuzzer corpora for changes to split-handshake serialization.
  * Serialize SSL curve list in handoff and check it on application.
  * Revert "Speed up ECDSA verify on x86-64."
  * Route the tuned add/dbl implementations out of EC_METHOD.
  * Speed up ECDSA verify on x86-64.
  * Include details about latest FIPS certification.
  * Serialize SSL configuration in handoff and check it on application.
  * Don't overflow state->calls on 16TiB RAND_bytes calls.
  * Buffer up QUIC data within a level internally.
  * Add an interface for QUIC integration.
  * Remove OPENSSL_NO_THREADS.
  * Minor fixes to bytestring.h header.
  * Test CBC padding more aggressively.
  * Restore CHECKED_CAST.
  * Fix EVP_tls_cbc_digest_record is slow using SHA-384 and short messages
  * Tidy up dsa_sign_setup.
  * Fix the build on glibc 2.15.
  * Modernize OPENSSL_COMPILE_ASSERT.
  * Fix redefinition of AEAD asserts in e_aes.c.
  * Guard sys/auxv.h include on !BORINGSSL_ANDROID.
  * Flatten EVP_AEAD_CTX
  * Implement SSL_get_tlsext_status_type
  * Fix documentation sectioning.
  * Remove support for GCC 4.7.
  * Print the name of the binary when blocking in getrandom.
  * Undo recent changes to |X509V3_EXT_conf_nid|.
  * Add a compatibility EVP_CIPH_OCB_MODE value.
  * [util] Mark srtp.h as an SSL header file
  * [rand] Disable RandTest.Fork on Fuchsia
  * Remove -fsanitize-cfi-icall-generalize-pointers.
  * Fix undefined function pointer casts in LHASH.
  * Use proper functions for lh_*.
  * Better handle AVX-512 assembly syntax.
  * Always push errors on BIO_read_asn1 failure.
  * Add a per-SSL TLS 1.3 downgrade enforcement option and improve tests.
  * Fix div.c to divide BN_ULLONG only if BN_CAN_DIVIDE_ULLONG defined.
  * Include aes.h in mode/internal.h
  * Fix section header capitalization.
  * Fix build in consumers that flag unused parameters.
  * [perlasm] Hide OPENSSL_armcap_P in assembly
  * Test the binary search more aggressively.
  * Opaquify CONF.
  * Bring Mac and iOS builders back to the CQ.
  * Remove LHASH_OF mention in X509V3_EXT_conf_nid.
  * Inline functions are apparently really complicated.
  * Actually disable RandTest.Fork on iOS.
  * Mostly fix undefined casts around STACK_OF's comparator.
  * Fix undefined casts in sk_*_pop_free and sk_*_deep_copy.
  * Take iOS builders out of the CQ rotation too.
  * Rewrite PEM_X509_INFO_read_bio.
  * Fix undefined block128_f, etc., casts.
  * Fix undefined function pointer casts in {d2i,i2d}_Foo_{bio,fp}
  * Fix undefined function pointer casts in IMPLEMENT_PEM_*.
  * Always print some diagnostic information when POST fails.
  * Disable RandTest.Fork on iOS.
  * Const-correct sk_find and sk_delete_ptr.
  * Add a test for STACK_OF(T).
  * Rename inject-hash: Bazel does not like hyphens.
  * Rename OPENSSL_NO_THREADS, part 1.
  * Fix ERR_GET_REASON checks.
  * Add a basic test for PEM_X509_INFO_read_bio.
  * Replace BIO_new + BIO_set_fp with BIO_new_fp.
  * Remove Mac try jobs from the CQ.
  * Add util/read_symbols.go
  * Tighten up getrandom handling.
  * Remove SHA384_Transform from sha.h.
  * Push an error on sigalg mismatch in X509_verify.
  * Sync bundled bits of golang.org/x/crypto.
  * Use Go modules with delocate.
  * Keep the GCM bits in one place.
  * Trim 88 bytes from each AES-GCM EVP_AEAD.
  * Set up Go modules.
  * Use sdallocx, if available, when deallocating.
  * Remove the add_alert hook.
  * Fix doc.go error capitalization.
  * Don't include quotes in heredocs.
  * Add missing bssl::UpRef overloads.
  * Roll back clang revision.
  * Update tools.
  * Fix BORINGSSL_NO_CXX.
  * Fix check of the pointer returned by BN_CTX_get
  * Include newlines at the end of generated asm.
  * Automatically disable assembly with MSAN.
  * Mark the C version of md5_block_data_order static.
  * Reorder some extensions to better match Firefox.
  * Make symbol-prefixing work on ARM.
  * Document alternative functions to BIO_f_base64.
  * Another batch of bools.
  * Add some RAND_bytes tests.
  * Support symbol prefixes
  * Fill in a fake session ID for TLS 1.3.
  * Create output directories for perlasm.
  * Fix Fiat path.
  * Fix GCC (8.2.1) build error.
  * Some more bools.
  * Flatten most of the crypto target.
  * Flatten assembly files.
  * Flatten the decrepit target.
  * Clarify "reference" and fix typo.
  * Fix corner case in cpuinfo parser.
  * Add some about ownership to API-CONVENTIONS.
  * Tidy up docs for #defines.
  * No negative moduli.
  * Document that ED25519_sign only fails on allocation failure
  * Clarify thread-safety of key objects.
  * shim: don't clear environment when invoking handshaker.
  * Switch the default TLS 1.3 variant to tls13_rfc.
  * Switch to Clang 6.0's fuzzer support.

-------------------------------------------------------------------
Tue Dec 11 14:33:09 UTC 2018 - Jan Engelhardt <jengelh@inai.de>

- Trim redundant wording. Use multi-file find -exec invocation.

-------------------------------------------------------------------
Fri Nov 16 11:09:39 UTC 2018 - Michał Rostecki <mrostecki@suse.de>

- To avoid conflicts with openssl development files, change all
  includes from openssl to boringssl.

-------------------------------------------------------------------
Fri Nov  9 14:16:22 UTC 2018 - Martin Pluskal <mpluskal@suse.com>

- Use optflags when building
- Do not create empty package

-------------------------------------------------------------------
Thu Nov 08 13:27:36 UTC 2018 - Michał Rostecki <mrostecki@suse.de>

- Update to version 20181026:
  * Automatically disable assembly with MSAN.
  * Switch the default TLS 1.3 variant to tls13_rfc.

-------------------------------------------------------------------
Wed Nov 07 13:54:49 UTC 2018 - Michał Rostecki <mrostecki@suse.de>

- Update to version 20181106:
  * Make SSL_get_current_cipher valid during QUIC callbacks.
  * Devirtualize ec_simple_{add,dbl}.
  * Refresh fuzzer corpora for changes to split-handshake serialization.
  * Serialize SSL curve list in handoff and check it on application.
  * Revert "Speed up ECDSA verify on x86-64."
  * Route the tuned add/dbl implementations out of EC_METHOD.
  * Speed up ECDSA verify on x86-64.
  * Include details about latest FIPS certification.
  * Serialize SSL configuration in handoff and check it on application.
  * Don't overflow state->calls on 16TiB RAND_bytes calls.
- Use tar_scm service for fetching sources and versioning.

-------------------------------------------------------------------
Wed Nov  7 09:45:31 UTC 2018 - Michał Rostecki <mrostecki@suse.de>

- Initial release - 0.0.0+git7499.6ec9e4
- Add add-soversion-option.patch - required to build libraries with
  soversion