)]}'
{
  "commit": "a2aa503f7a9b428576bb82e194bc96c3c88563e6",
  "tree": "5073bd01a3783b3efc07f3e8f7850e8aa433421a",
  "parents": [
    "5cb55c317a25d4dd7c9d0a98857cfc7727df4486"
  ],
  "author": {
    "name": "Piotr Sikora",
    "email": "piotrsikora@google.com",
    "time": "Mon Oct 22 21:22:47 2018 -0700"
  },
  "committer": {
    "name": "Piotr Sikora",
    "email": "piotrsikora@google.com",
    "time": "Wed Oct 24 15:31:21 2018 +0000"
  },
  "message": "Bazel: update BoringSSL to 4b96833 / a200d14 (master-with-bazel).\n\nThis update includes the following changes:\n\n4b968339 Add a compatibility EVP_CIPH_OCB_MODE value.\n0e150027 [util] Mark srtp.h as an SSL header file\n8c659c1f [rand] Disable RandTest.Fork on Fuchsia\n6650898e Remove -fsanitize-cfi-icall-generalize-pointers.\nb68b8322 Fix undefined function pointer casts in LHASH.\n1eff9482 Use proper functions for lh_*.\nb0189084 Better handle AVX-512 assembly syntax.\n80aa6949 Always push errors on BIO_read_asn1 failure.\n2d98d49c Add a per-SSL TLS 1.3 downgrade enforcement option and improve tests.\ne3418028 Fix div.c to divide BN_ULLONG only if BN_CAN_DIVIDE_ULLONG defined.\n28babde1 Include aes.h in mode/internal.h\n62a4dcd2 Fix section header capitalization.\ne1ee0f5b Fix build in consumers that flag unused parameters.\nc1eef7f7 [perlasm] Hide OPENSSL_armcap_P in assembly\nce00828c Test the binary search more aggressively.\nfac6fb99 Opaquify CONF.\n9e97c022 Bring Mac and iOS builders back to the CQ.\ne17e14df Remove LHASH_OF mention in X509V3_EXT_conf_nid.\na943613e Inline functions are apparently really complicated.\n7c3ce519 Actually disable RandTest.Fork on iOS.\n52483994 Mostly fix undefined casts around STACK_OF\u0027s comparator.\nfb4e2e0f Fix undefined casts in sk_*_pop_free and sk_*_deep_copy.\ncbc3e076 Take iOS builders out of the CQ rotation too.\n792c1dc4 Rewrite PEM_X509_INFO_read_bio.\n73535ab2 Fix undefined block128_f, etc., casts.\n419144ad Fix undefined function pointer casts in {d2i,i2d}_Foo_{bio,fp}\n217bfd3c Fix undefined function pointer casts in IMPLEMENT_PEM_*.\n3474270a Always print some diagnostic information when POST fails.\n13fd6274 Disable RandTest.Fork on iOS.\n8d2f4b99 Const-correct sk_find and sk_delete_ptr.\n892a31b5 Add a test for STACK_OF(T).\n7039f403 Rename inject-hash: Bazel does not like hyphens.\n5b33effa Rename OPENSSL_NO_THREADS, part 1.\n1764d7a3 Fix ERR_GET_REASON checks.\ne7692f55 Add a basic test for PEM_X509_INFO_read_bio.\nfb86b888 Replace BIO_new + BIO_set_fp with BIO_new_fp.\nc93711b1 Remove Mac try jobs from the CQ.\n066b1089 Add util/read_symbols.go\n5ede28c8 Tighten up getrandom handling.\n49025989 Remove SHA384_Transform from sha.h.\n371305f5 Push an error on sigalg mismatch in X509_verify.\nca4971cb Sync bundled bits of golang.org/x/crypto.\n5baee456 Use Go modules with delocate.\n302ef5ee Keep the GCM bits in one place.\n580be2b1 Trim 88 bytes from each AES-GCM EVP_AEAD.\n0990a552 Set up Go modules.\nb5e4a225 Use sdallocx, if available, when deallocating.\nd1673c21 Remove the add_alert hook.\n3f18c4c5 Fix doc.go error capitalization.\nff997452 Don\u0027t include quotes in heredocs.\n5cf05ad2 Add missing bssl::UpRef overloads.\n350257db Roll back clang revision.\n8b60cde1 Update tools.\n689019fe Fix BORINGSSL_NO_CXX.\nbef6cc29 Fix check of the pointer returned by BN_CTX_get\n695e589b Include newlines at the end of generated asm.\ne77c27d7 Automatically disable assembly with MSAN.\n967cd821 Mark the C version of md5_block_data_order static.\nd6680958 Reorder some extensions to better match Firefox.\n19ac2666 Make symbol-prefixing work on ARM.\n4b85a945 Document alternative functions to BIO_f_base64.\n8525ff31 Another batch of bools.\n632d1127 Add some RAND_bytes tests.\n8c7c6356 Support symbol prefixes\n492c9aa9 Fill in a fake session ID for TLS 1.3.\ne84c3753 Create output directories for perlasm.\n3a08fbd2 Fix Fiat path.\n3faf3db6 Fix GCC (8.2.1) build error.\n12f58786 Some more bools.\n681ff277 Flatten most of the crypto target.\n1fcae84a Flatten assembly files.\nd144539d Flatten the decrepit target.\n8e09d901 Clarify \"reference\" and fix typo.\n8cd61f71 Fix corner case in cpuinfo parser.\nf016f814 Add some about ownership to API-CONVENTIONS.\n92812cb7 Tidy up docs for #defines.\n53affef4 No negative moduli.\n67e64342 Document that ED25519_sign only fails on allocation failure\n2556f8ba Clarify thread-safety of key objects.\ne768212e shim: don\u0027t clear environment when invoking handshaker.\n6855e0a4 Switch the default TLS 1.3 variant to tls13_rfc.\n9c969bf4 Switch to Clang 6.0\u0027s fuzzer support.\n7f4f41fa Don\u0027t depend on extension ordering to avoid an empty final extension.\n23849f09 Fix TLS 1.3 downgrade tests.\n1c2532ff Fix error strings for SSL_R_TLS13_DOWNGRADE.\n4ac9405e Remove unused BORINGSSL_PREFIX.\n21558f43 Document error behavior of PKCS5_PBKDF2_HMAC and EVP_PBE_scrypt\n1c2779e8 Don\u0027t let a NULL mean the initial SSL_CTX in SSL_set_SSL_CTX.\n929fd44f Update URL for GN quick start guide.\na130ce0b Update TLS 1.3 citations for the final RFC.\nc4131a4a Support the allocating case of i2d_ASN1_{BOOLEAN,OBJECT}.\n378cca80 Handle a modulus of -1 correctly.\n01e8e625 Don\u0027t allow RC4 in PEM.\nf1af129f Implement TLS 1.3 anti-downgrade signal.\nae322395 Remove dummy PQ padding extension.\ncac346ed Update Miller–Rabin check numbers.\n97816995 Document error behavior of various functions\ndea6d90d Document failure conditions of some EVP, HMAC, and CBB functions\n28655677 Use Span/Array for ticket decryption.\n6b0d8222 Format ssl/internal.h with clang-format.\nbc3286bb Add a pile of compatibility functions.\n5e3c8a61 Bound two other cases of PKCS#12 iteration counts.\nd4514530 Implement final TLS 1.3 RFC!!!\n1c337e56 Option to reverify certs on resumption.\nbdc40980 Add new curve/hash ECDSA combinations from Wycheproof.\naf37f848 Add RSA-PSS tests from Wycheproof.\nf84c0dad Use newly-sharded ECDH tests.\n367115b0 Fix SSL_CTX_set1_sigalgs fuzzer and make them all more type-safe.\na711b53e Update Wycheproof test vectors.\nad040c59 \"Update\" clang.\ne6fd125d Align on a single CMake style.\nddedf6d4 Fix SSL_CTX_set1_sigalgs_list fuzzer.\n17dc94e8 Add -handshaker-path to run_test.\n678c841c Use -flto\u003dthin in the CFI bot.\n4e446f27 Update citations to RFC 8410.\n8625ec4b No-op commit to kick the bots.\n69e91902 Work around missing MSan interceptor for posix_spawn.\ne9ae99bb Add an option to statically link a custom libc++.\n1f0d54b8 Don\u0027t assert on uninitialized memory in tests.\n1beddac9 Update tools.\n7c1f21a1 Add XChaCha20-Poly1305 AEAD.\na3202d7b Add EVP_CTRL_AEAD_* constants.\n826ce150 Support OpenSSL APIs SSL[_CTX]_set1_sigalgs[_list].\ne3ffaae0 Remove apparently unused cq_name field.\nad8e29b0 Add linux_fuzz to the CQ.\n3314d157 Escape backslashes in crypto test data.\n04e149f8 Set the fuzzer PBKDF2 limit to 2048.\nc81965a8 Set PBKDF2 limit in PKCS#12 to 100M.\n2bcb3151 Limit the number of PBKDF2 iterations when fuzzing.\n6410e18e Update several assembly files from upstream.\ne2779394 Don\u0027t accept “SSL client” as a substitute for S/MIME in the Netscape cert type extension.\ne833a6df handshaker: kick PRNG when resuming in UNSAFE_DETERMINISTIC_MODE.\n74bfa0c0 Fix header include for handshake.\ne5388e09 Add handshaker as run_tests dependency.\n8bd1d075 Require basicConstraints cA flag in intermediate certs.\n0224a329 Add X509_V_FLAG_REQUIRE_CA_BASIC_CONSTRAINTS.\ne7b78770 Ask shim whether it supports split handshakes.\n548c2764 shim: perform split handshakes in a separate binary.\nc448f175 Fix the build with FIPS + NO_ASM.\nfadd8b42 Add script for showing FIPS self-test failures.\n4732c544 Add ECDH_compute_key_fips inside the module.\nc4f3b8a2 Add a compile time verification ciphers are sorted for bsearch()\n23e9aec9 Support Wycheproof vectors with the curve given in the group.\nf3bfab00 Comment change in codereview.settings\ned09f2d5 Move the MSan sanity check to a source file.\n9af1edbe Don\u0027t build test/malloc.cc with TSAN.\n22ac2d9b Fail the build if MSan is built with assembly.\nfc04cb21 Add some TSan coverage of CRYPTO_BUFFER.\n6c04bd11 Add some basic SSL_CTX threading tests.\nc5f680ec Add a thread test for RSA.\n5852cfcc Add a basic TSan test for ref-counts.\n20b6a4e2 Clear r-\u003eneg in bn_mod_{add,sub}_consttime.\nd154c7cc shim: call SSL_CTX_set_tlsext_ticket_keys() only once.\n6d597a34 shim: rewrite MoveTestState() to use a serialized representation.\n0cbb1af4 Don\u0027t mint TLS 1.3 tickets if SSL_OP_NO_TICKETS is set.\n5869eb39 Test cert_cb and certificate verify ordering.\nc59b9aac Remove more remnants of SSLv3.\n8d1203d6 Fix some malloc error handling.\n861abccb Switch a bunch of ints to bools.\n3218c1db Add support for building ppc64le with bazel\n35b4a125 Namespace CertCompressionAlg and use more scopers.\n89b9ecf0 Add more scopers.\nbc118ee6 Add SSL_get0_peer_verify_algorithms.\n0a3e07ac Remove custom extensions support.\n42ea84b3 Update Wycheproof test vectors.\nce777626 shim: extract a |DoSplitHandshake| helper function.\n79f1a49c Update delocate to handle new compiler output.\na4e9f8d3 Simplify SSLTranscript.\ne0afc857 Send an alert if we fail to pick a signature algorithm.\n428fb3ad Make |BORINGSSL_MAKE_UP_REF| a no-op when C++ is disabled.\nc312fd02 Remove MoveTestConfig().\n82639e6f Use a pool of |rand_state| objects.\n4685376b Remove other unnecessary tlsext_ prefixes.\n7bb0fbf7 C++ the ticket keys a bit.\n0ce090ac A bunch more scopers.\n50596f8f Switch some easy SSL fields to UniquePtr.\nc1389f2c Give SSL and SSL_CTX dummy constructor and destructor.\n49798037 Unsplit SSL and SSL_CTX.\ne7b2b13f Add link to CMake bugfix.\nc7db3232 Add “bssl::” prefix to |UpRef| and |PushToStack| in fuzzer code.\n85967951 Drop C++ from certificate compression API.\nd2f87a77 shim: move handshake helper functions into their own file.\nf2bc5f49 shim: move |TestState| and |TestConfig| to their own files.\nbfdd1a93 Give SSL_SESSION a destructor.\n58150ed5 Add lh_FOO_retrieve_key to avoid stack-allocating SSL_SESSION.\n63c79122 Remove the redundant version check in ssl_session_cmp.\n53d2c7a8 Remove fail_second_ddos_callback.\n2908dd14 Add bssl::UpRef.\n2e74fdaa Don\u0027t redefine alignas in C++.\naaef8334 Use more accessors in ssl_test.cc\n0363de9a Namespace SSL_X509_METHOD.\na3a71e9d Flip SSL_SESSION fields to bool.\n997ff094 shim: move |SettingsWriter| into its own file.\n791f2822 Fix VS build when assembler is enabled\n26f82971 Switch to 64-bit tools on Windows.\n0cc51a79 Remove reference to SSL3 in PORTING.md.\n9c3b120b [fuchsia] Update to zx_cprng_draw\na0373182 Update QUIC transport parameters extension codepoint\n9bb15f58 Remove SSL 3.0 implementation.\nfec83fc7 Order draft-28 over draft-23.\n3815720c Add a bunch of compatibility functions for PKCS#7.\neaf0a17d Add a copy of NASM to util/bot/ in BoringSSL.\n79c97bf3 Allow empty return values from PKCS7_get_*.\n8803c058 Properly advance the CBS when parsing BER structures.\nb4810de6 Make X509 time validation stricter.\n03de6813 Write error messages in the FIPS module to stderr.\nbcfb4991 Add special AES-GCM AEAD for TLS 1.3.\n954eefae Actually add AES-192-OFB.\n0080d83b Implement the client side of certificate compression.\nf6e5d0d5 Add AES-192-OFB.\n7139f755 Fix some timing leaks in the DSA code.\n9f9c938a Revert \"Reland \"Revert \"Add other Windows configurations to the CQ.\"\"\"\n23aa4d22 Update tools.\ndd935202 Zero-initialize tmp in ec_GFp_simple_mul_single.\n6ff2ba80 [fuchsia] Update to zx_cprng_draw_new\n43eb0af5 Reland \"Revert \"Add other Windows configurations to the CQ.\"\"\n23e92d5d Revert \"Revert \"Add other Windows configurations to the CQ.\"\"\n4665da6e Add OFB ciphers to EVP_get_cipherbyname.\n3b2ff028 Add SSL_SESSION_get0_id_context.\nb570fd9f Link advapi32.lib when linking crypto.\n070151c9 Update ECDH and EVP tests to accept latest Wycheproof vectors.\n1c68fa23 Hide SSL_SESSION.\n3e2b3ee2 Hand back in-progress handshakes after a session resumption.\n5267ef7b Reject unexpected application data in bidirectional shutdown.\na307cb7d Preliminary support for compressed certificates.\nc1e4f338 Use std::thread in thread_test.cc.\n1627871d Include bn/internal.h for RSAZ code.\n7bf0bccd Add missing \u003ccondition_variable\u003e include.\ncaf8ddd0 Add SSL_SESSION_set1_id.\n81a6f6d8 Add a tool to check for filename collisions.\nfe7a1744 Fix typo.\na827d180 Match OpenSSL\u0027s EVP_MD_CTX_reset return value.\n9229b4fb Fix typo in build flags.\n700631bd Pack encrypted handshake messages together.\n81d4a03b Update tools.\nf86693df Document the correct nonce length for AES-GCM.\n\nChange-Id: Ifafe3719b9e1c923806868c414c2a2878d3df6e6\nSigned-off-by: Piotr Sikora \u003cpiotrsikora@google.com\u003e\nReviewed-on: https://nginx-review.googlesource.com/c/3505\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d5e52810591fb7b0f30c65b1ecfd421fe644f1a6",
      "old_mode": 33188,
      "old_path": "build.bzl",
      "new_id": "b41698218301c971e56b44543793a3bff33e1b10",
      "new_mode": 33188,
      "new_path": "build.bzl"
    }
  ]
}