package:boringIn the fetch and checkout build modes, hook/build.dart provides:
dart run, dart test, and Flutter debug builds).dart build, and Flutter profile and release builds), which hook/link.dart links into a tree-shaken dynamic library containing only the functions recorded via @RecordUse().Every GitHub Release contains both the dynamic and the static library for each prebuilt target in lib/src/hook_helpers/targets.dart.
The package:boring binaries workflow builds the prebuilt libraries (tool/precompile_binaries.dart) from the vendored BoringSSL whenever a change to the native sources (src/, third_party/boringssl/, or tool/REVISION) lands on main, attaches them to a boring-binaries-<date>-<commit> pre-release with a provenance attestation (gh attestation verify <file> --repo dart-lang/tools), and opens a pull request (tool/regenerate_hashes.dart) that pins their SHA-256 hashes in lib/src/hook_helpers/hashes.dart.
CI (tool/check_prebuilt_binaries.sh) checks that a release of this package pins libraries built from the sources it vendors, so fetch and checkout produce the same BoringSSL.
Run ./tool/bump-boringssl-revision.sh [revision] to update the vendored BoringSSL under third_party/boringssl/, record the commit in tool/REVISION, and regenerate the FFI bindings (tool/ffigen.dart). The generated job in boring.yaml runs on ubuntu-24.04 and verifies that all generated files and hashes.dart are up to date.
The refresh job in the same workflow runs the script weekly against the latest BoringSSL revision and opens a pull request with the result.
test/conformance/x509_limbo_test.dart runs the x509-limbo path validation suite against the vendored BoringSSL, and x509_limbo_expected_failures.txt records the testcases BoringSSL is known to disagree with. The x509-limbo job fails on a divergence that the list does not record, and on a listed testcase that started agreeing, so the list cannot go stale.
BoringSSL's X.509 behavior changes between revisions. After updating it, run
X509_LIMBO_REGENERATE=1 ./tool/run_x509_limbo_tests.sh
to regenerate the list, and read the diff to see the change in behavior. The refresh job does this for its pull requests, so a change to the list there is part of what to review.