Skip to content

sync upstream#74

Merged
0x676e67 merged 20 commits intomasterfrom
sync
May 30, 2025
Merged

sync upstream#74
0x676e67 merged 20 commits intomasterfrom
sync

Conversation

@0x676e67
Copy link
Copy Markdown
Owner

continue: #72

rushilmehra and others added 20 commits March 31, 2025 12:34
Newer versions of FIPS don't need any special casing in our bindings,
unlike the submoduled boringssl-fips. In addition, many users currently
use FIPS by precompiling BoringSSL with the proper build tools and
passing that in to the bindings.

Until we adopt the Update Stream pattern for FIPS, there are two main
use cases:

1. Passing an unmodified, precompiled FIPS validated version of
   boringssl (fips-precompiled)

2. Passing a custom source directory of boringssl meant to be linked
   with a FIPS validated bcm.o. This is mainly useful if you carry
   custom patches but still want to use a FIPS validated BoringCrypto.
   (fips-link-precompiled)

This commit introduces the `fips-precompiled` feature and removes the
`fips-no-compat` feature.
* boring(x509): impl Clone of X509Store
This method reliably retrieves the certificate the `X509_STORE_CTX` is
verifying, unlike `X509_STORE_CTX_get_current_cert`, which may return
the "problematic" cert when verification fails.
* Revert "feat(x509): Implement `Clone` for `X509Store` (#339)"

This reverts commit 49a8d09.

See <cloudflare/boring#120>.

* Ensure Clone is not added to X509Store

* Add comment about why X509Store must not implement Clone

---------

Co-authored-by: Kornel <kornel@cloudflare.com>
@0x676e67 0x676e67 merged commit 0f2461a into master May 30, 2025
41 checks passed
@0x676e67 0x676e67 deleted the sync branch June 7, 2025 01:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants