Bump BoringSSL, OpenSSL, AWS-LC in CI (#13123)

Co-authored-by: pyca-boringbot[bot] <pyca-boringbot[bot][email protected]>

Author: pyca-boringbot[bot]

.github/workflows/ci.yml

@@ -40,12 +40,12 @@ jobs:
           - {VERSION: "3.13", NOXSESSION: "tests-ssh", OPENSSL: {TYPE: "openssl", VERSION: "3.5.0"}}
           - {VERSION: "3.13", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "4.0.0"}}
           - {VERSION: "3.13", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "4.1.0"}}
-          # Latest commit on the BoringSSL main branch, as of Jun 26, 2025.
-          - {VERSION: "3.13", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "boringssl", VERSION: "78b48c1f2a973ff0a4ed18b9618d533101bd4144"}}
+          # Latest commit on the BoringSSL main branch, as of Jul 01, 2025.
+          - {VERSION: "3.13", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "boringssl", VERSION: "db421c2d800f6d2e164366af6a28bc52b2dafbf7"}}
           # Latest tag of AWS-LC main branch, as of Jun 28, 2025.
           - {VERSION: "3.13", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "aws-lc", VERSION: "v1.54.0"}}
-          # Latest commit on the OpenSSL master branch, as of Jun 27, 2025.
-          - {VERSION: "3.13", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "7bdc0d13d2b9ce1c1d0ec1f89dacc16e5d045314"}}
+          # Latest commit on the OpenSSL master branch, as of Jul 01, 2025.
+          - {VERSION: "3.13", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "b3161bd9a9329be3d6bf6b29a06835e2721898bb"}}
           # Builds with various Rust versions. Includes MSRV and next
           # potential future MSRV.
           # - 1.77: offset_of! in std (for pyo3), c"str" literals (replace cstr_from_literal)

src/rust/src/backend/rsa.rs

@@ -263,6 +263,8 @@ fn setup_signature_ctx(
                     ),
                 ));
             }
+            // AUTO and MAXIMUM are the same in OpenSSL.
+            ctx.set_rsa_pss_saltlen(openssl::sign::RsaPssSaltlen::MAXIMUM_LENGTH)?;
         } else {
             ctx.set_rsa_pss_saltlen(openssl::sign::RsaPssSaltlen::custom(salt.extract::<i32>()?))?;
         };

src/rust/src/buf.rs

@@ -50,10 +50,8 @@ fn _extract_buffer_length<'p>(
 ) -> pyo3::PyResult<(pyo3::Bound<'p, pyo3::PyAny>, usize, usize)> {
     let py = pyobj.py();
     let bufobj = if mutable {
-        let kwargs = pyo3::types::IntoPyDict::into_py_dict(
-            [(pyo3::intern!(py, "require_writable"), true)],
-            py,
-        )?;
+        let kwargs = [(pyo3::intern!(py, "require_writable"), true)];
+        let kwargs = pyo3::types::IntoPyDict::into_py_dict(kwargs, py)?;
         types::FFI_FROM_BUFFER
             .get(py)?
             .call((pyobj,), Some(&kwargs))