[beta] Roll BoringSSL from 5e1bfb45c353 to c7eb007fd106 (81 revisions) https://boringssl.googlesource.com/boringssl.git/+log/5e1bfb45c353..c7eb007fd106 2026-10-22 chlily@google.com Avoid Windows cross-dll constexpr issue in digest_test.cc 2026-10-08 xfding@google.com crypto: Move statics into anonymous namespace, Round 2 2026-10-07 xfding@google.com crypto: Put more statics into anonymous namespace 2026-10-07 xfding@google.com crypto/evp: Export SHAKE256 and TurboSHAKE256 as EVP_MD 2026-10-12 jjpat@google.com Precompute the PK.seed SHA-256 state in SLH-DSA-SHA2 2026-10-08 chlily@google.com crypto/x509 MTC: Allow empty cosignature values in MTCProof 2026-10-18 xfding@google.com rust/bssl-tls: Allow libraries to pick alert when cert_cb fails 2026-10-20 davidben@google.com Update presubmit.yml per review comments 2026-09-13 davidben@google.com Remove odd special case around policy validation 2026-09-13 davidben@google.com Report X509_V_ERR_CERT_CHAIN_TOO_LONG if the chain was too long 2026-09-14 davidben@google.com X509_V_FLAG_CRL_CHECK_ALL should skip the trust anchor 2026-09-14 davidben@google.com Remove dead code for picking a CRL issuer 2026-09-13 davidben@google.com Rewrite the path builder 2026-10-07 davidben@google.com Test X509_V_FLAG_CRL_CHECK_ALL 2026-10-20 davidben@google.com Update MODULE.bazel for 0.20261020.0 2026-10-20 davidben@google.com Block a handful of intermediate certificates 2026-10-20 chlily@google.com Rename "agents" directory (containing AI skills) to "_agents" 2026-10-19 tomhughes@chromium.org rand: Fix double-free on thread-local failure. 2026-10-01 chlily@google.com EVP_HPKE_KEM: Align HPKE error codes with EVP_KEM 2026-10-07 chlily@google.com EVP_HPKE_KEM: Clean up legacy KEM implementation hooks 2026-09-13 davidben@google.com Test various odd cases when the target certificate is in the trust store 2026-09-13 davidben@google.com Test X509_verify_cert in two ways 2026-09-13 davidben@google.com Test some special error codes when we cannot build a path 2026-10-01 chlily@google.com Export EVP_KEMs corresponding to DHKEMs 2026-10-01 chlily@google.com EVP_HPKE_KEM: Implement DHKEM(P256, HKDF-SHA256) using EVP_KEM_DHKEM 2026-09-17 chlily@google.com EVP_HPKE_KEM: Implement DHKEM(X25519, HKDF-SHA256) using EVP_KEM_DHKEM 2026-10-16 davidben@google.com Also test that EVP_PKEY_from_ec_private_scalar rejects zero 2026-10-18 agl@imperialviolet.org SLH-DSA: SHAKE variants are not approved. 2026-09-13 davidben@google.com x509_test: Fix some style mishaps 2026-10-06 xfding@google.com rust/bssl-crypto: CPace support 2026-10-13 jjpat@google.com Use lazy reduction and parallel ExpandMask in ML-DSA 2026-08-20 xfding@google.com rust: bssl-tls: Allow recognition of deprecated protocol version 2026-10-13 jjpat@google.com Use lazy reduction in ML-KEM matrix-vector products 2026-09-12 davidben@google.com Make X509_check_trust and X509_check_purpose const 2026-10-18 xfding@google.com ssl: Reset cert_cb back to unset 2026-10-18 davidben@google.com Const-correct a bunch more functions 2026-10-07 xfding@google.com crypto/evp: Add SHA3-384 2026-10-16 davidben@google.com Const-correct X509_STORE_add_{cert,crl} 2026-09-12 davidben@google.com Mark x509v3_cache_extensions as const 2026-09-12 davidben@google.com Pass depth explicitly into CRL functions 2026-09-12 davidben@google.com Remove current_crl_issuer and current_crl_score 2026-09-12 davidben@google.com Remove X509_STORE_CTX_get0_current_crl 2026-09-12 davidben@google.com Use UniquePtr some more in CRL handling 2026-09-12 davidben@google.com Make most verify sites fill in current_cert implicitly 2026-10-07 xfding@google.com crypto/evp: Add SHA3-256 and SHA3-512 2026-10-09 xfding@google.com mem: Constify all APIs wherever it applies 2026-10-14 xfding@google.com crypto/asn1: Rectify the length type of ASN1_STRING 2026-10-13 xfding@google.com crypto/asn1: Assert on negative length value 2026-10-15 davidben@google.com Remove now unnecessary out-of-line ctors and dtors 2026-09-12 davidben@google.com Rewrite internal_verify 2026-09-12 davidben@google.com No-op X509_V_FLAG_CHECK_SS_SIGNATURE 2026-10-13 chlily@google.com Fold SSL_CTX_set_grease_sigalgs_enabled into SSL_CTX_set_grease_enabled 2026-10-08 chlily@google.com crypto/x509 MTC: Update to draft -07 2026-09-23 xfding@google.com util/fipstools/inject_hash: Add -ignore-missing-symbols flag and tests 2026-09-12 davidben@google.com Make the other dup_ref functions take nullptr 2026-10-08 xfding@google.com Sweep through the library and add `dup_ref` ref-counting 2026-09-12 davidben@google.com Test some behavior in X509_V_FLAG_CB_ISSUER_CHECK 2026-10-06 xfding@google.com rust: Retire bssl-macros 2026-10-08 mattm@google.com Add MTC draft plants-07 support (for pki/). 2026-10-08 chlily@google.com Define V_ASN1_RELATIVE_OID tag number 2026-10-07 tomhughes@chromium.org entropy: Avoid volatile post-increment under C++20 2026-10-08 chlily@google.com crypto/x509 MTC: Tighten MTC subjectPublicKeyInfoHash length check 2026-10-08 chlily@google.com crypto/x509 MTC: Reject trailing data in MTC CA extension 2026-09-17 chlily@google.com EVP_HPKE_KEM: Move constants and serialization hooks to HpkeKeyMethod 2026-10-06 quimmuntal@gmail.com ssl/test/runner: use hash.Cloner when copying hash instances 2026-10-01 chlily@google.com EVP_KEM: Add an optional check_key hook 2026-10-02 wdauchy@gmail.com Speed up copy_from_prebuf by accumulating in registers 2026-10-07 xfding@google.com crypto: Remove redundant statics 2026-09-17 chlily@google.com EVP_KEM: Pass EVP_KEM* into function pointers 2026-10-07 xfding@google.com util: Report the line number where docgen failed 2026-09-24 xfding@google.com ssl: Move deprecated APIs out 2026-09-30 davidben@google.com Update trust anchor IDs for draft-06 2026-09-30 xfding@google.com ssl: Allow multipart rule commutative 2026-08-07 xfding@google.com curve25519: CPace implementation 2026-10-06 davidben@google.com Remove deprecated split handshakes support 2026-09-30 xfding@google.com ssl: Update SSL_CIPHER_get_min_version to reflect SSL 3.0 removal 2026-09-30 mattm@google.com CheckOCSP and CheckCRL: make delegate non-optional 2026-10-02 antoinedesbois@google.com Add X509CertificateBuilder to bssl-x509 2026-10-02 antoinedesbois@google.com Add PrivateKey::from_der to bssl-x509 2026-10-02 antoinedesbois@google.com Add DTLS-SRTP extension APIs to bssl-tls 2026-09-30 agl@imperialviolet.org Add FIPS break tests for the jitter RCT and APT. If this roll has caused a breakage, revert this CL and set the roller to dry run mode using the controls here: https://autoroll.skia.org/r/boringssl-dart-sdk Please CC dart-engprod@google.com,dart-vm-gardener@rotations.google.com,dart-vm-team@google.com on the revert to ensure that a human is aware of the problem. To file a bug in BoringSSL: https://crbug.com/boringssl/new To file a bug in Dart SDK: https://github.com/dart-lang/sdk/issues To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Issue description: The beta branch BoringSSL (5e1bfb45c353) predates upstream fixes including blocking of compromised intermediate certificates. What is the fix: Roll BoringSSL to c7eb007fd106, the same revision as main. Why cherry-pick: Ship the upstream certificate blocklist and X.509 fixes on beta. Risk: Low to medium. DEPS-only roll (no SDK build changes), but a larger jump than the roll on main; same revision as main. Issue link(s): https://boringssl.googlesource.com/boringssl.git/+log/5e1bfb45c353..c7eb007fd106 R=vegorov@google.com Cherry-pick: https://dart-review.googlesource.com/c/sdk/+/568000 Change-Id: I26d3d37a603c39a32d637a51520e843ea14fd2c8 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/568202 Commit-Queue: Alexander Thomas <athom@google.com> Reviewed-by: Slava Egorov <vegorov@google.com>
diff --git a/DEPS b/DEPS index 84e1532..38b053c 100644 --- a/DEPS +++ b/DEPS
@@ -105,7 +105,7 @@ # Prefer to use hashes of binaryen that have been reviewed & rolled into g3. "binaryen_rev" : "1c0c9f3836e858e01c4f94ac2e5a936d16a6ba1d", - "boringssl_rev": "5e1bfb45c353b2bb36bdf26b006ea8f5566c82d5", + "boringssl_rev": "c7eb007fd10627f1abb41a3e368b85e24cd20af9", "browser-compat-data_tag": "ac8cae697014da1ff7124fba33b0b4245cc6cd1b", # v1.0.22 "cpu_features_rev": "936b9ab5515dead115606559502e3864958f7f6e", "devtools_rev": "85f945ac99379d64d4df6f67d9b011e4cc418e7e",