Skip to content

Commit 81d4aa1

Browse files
Merge in upstream v4.18.0
2 parents bb42da5 + 404a753 commit 81d4aa1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+1293
-221
lines changed

.github/workflows/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ jobs:
242242

243243
test-fips:
244244
name: Test FIPS integration
245-
runs-on: ubuntu-20.04
245+
runs-on: ubuntu-latest
246246
steps:
247247
- uses: actions/checkout@v4
248248
with:
@@ -342,7 +342,7 @@ jobs:
342342

343343
test-features:
344344
name: Test features
345-
runs-on: ubuntu-20.04
345+
runs-on: ubuntu-latest
346346
steps:
347347
- uses: actions/checkout@v4
348348
with:

Cargo.toml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ members = [
88
resolver = "2"
99

1010
[workspace.package]
11-
version = "4.15.0"
11+
version = "4.18.0"
1212
repository = "https://github.com/cloudflare/boring"
1313
edition = "2021"
1414

@@ -19,11 +19,11 @@ tag-prefix = ""
1919
publish = false
2020

2121
[workspace.dependencies]
22-
boring-sys = { version = "4.15.0", path = "./boring-sys" }
23-
boring = { version = "4.15.0", path = "./boring" }
24-
tokio-boring = { version = "4.15.0", path = "./tokio-boring" }
22+
boring-sys = { version = "4.18.0", path = "./boring-sys" }
23+
boring = { version = "4.18.0", path = "./boring" }
24+
tokio-boring = { version = "4.18.0", path = "./tokio-boring" }
2525

26-
bindgen = { version = "0.70.1", default-features = false, features = ["runtime"] }
26+
bindgen = { version = "0.72.0", default-features = false, features = ["runtime"] }
2727
bytes = "1"
2828
cmake = "0.1.18"
2929
fs_extra = "1.3.0"

RELEASE_NOTES

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,49 @@
1+
4.18.0
2+
- 2025-05-29 Add set_verify_param
3+
- 2025-05-28 Add support for X509_STORE_CTX_get0_untrusted
4+
- 2025-06-02 Add X509VerifyParamRef::copy_from (#361)
5+
- 2025-06-02 Fix X509VerifyContextRef::set_verify_param (#358)
6+
- 2025-06-02 Ensure we call X509_STORE_CTX_cleanup on error path too (#360)
7+
- 2025-06-02 Add mutable ex_data APIs for X509StoreContext
8+
- 2025-06-02 Add X509StoreContextRef::init_without_cleanup
9+
- 2025-06-04 Rename to reset_with_context_data
10+
- 2025-06-05 Avoid panicking in error handling
11+
- 2025-06-05 Don't unwrap when Result can be returned instead
12+
- 2025-06-04 Make X509Store shareable between contexts
13+
- 2025-06-05 Sprinkle #[must_use] (#368)
14+
- 2025-06-05 Expose SSL_set1_groups to Efficiently Set Curves on SSL Session (#346)
15+
- 2025-06-09 Upgrade bindgen to v0.72.0
16+
- 2025-06-13 Expose PKey::raw_{private,public}_key (#364)
17+
- 2025-06-10 Don't link binaries on docs.rs
18+
- 2025-06-11 Use cargo:warning for warnings
19+
20+
4.17.0
21+
- 2025-05-27 Revert "feat(x509): Implement `Clone` for `X509Store` (#339)" (#353)
22+
- 2025-05-14 Update bindgen from 0.70.1 -> 0.71.1.
23+
- 2025-05-19 Add `X509_STORE_CTX_get0_cert` interface
24+
- 2025-05-18 boring(ssl): use `corresponds` macro in `add_certificate_compression_algorithm`
25+
- 2025-02-14 Update Cargo.toml
26+
- 2025-02-13 build: Fix the build for 32-bit Linux platform
27+
- 2025-05-20 rustfmt ;(
28+
- 2025-05-20 Fix linking SystemFunction036 from advapi32 in Rust 1.87
29+
- 2025-05-20 Clippy
30+
- 2025-05-01 add SslCurve::X25519_MLKEM768 constant
31+
- 2025-04-17 Use ubuntu-latest for all ci jobs
32+
- 2025-04-16 fix clippy error
33+
- 2025-04-15 expose SSL_set_compliance_policy
34+
- 2025-04-07 feat(x509): Implement `Clone` for `X509Store` (#339)
35+
36+
4.16.0
37+
- 2025-03-31 Add fips-precompiled feature to support newer versions of FIPS (#338)
38+
- 2025-03-18 Document linking to C++ standard library (#335)
39+
- 2025-03-18 Revert "Remove "fips-no-compat", decouple "fips-compat" from "fips"" (#334)
40+
- 2025-03-11 boring: Disable `SslCurve` API with "fips" feature
41+
- 2025-03-11 boring-sys: Ignore patches when boringSSL is precompiled
42+
- 2025-03-13 Remove "fips-no-compat", decouple "fips-compat" from "fips"
43+
- 2025-03-14 Add feature "fips-no-compat"
44+
- 2025-03-10 Advertise X25519MLKEM768 with "kx-client-pq-preferred" (#329)
45+
- 2025-03-10 Update to actions/cache@v4 (#328)
46+
- 2025-02-28 Add missing release notes entry (#324)
147

248
4.15.0
349
- 2025-02-27 Expose API to enable certificate compression. (#241)
@@ -517,7 +563,7 @@
517563
- 2019-12-01 Change *const to *mut to try if it fixes tests
518564
- 2019-12-01 move EVP_PKCS82PKEY into evp module
519565
- 2019-12-01 Support for PKCS#8 unencrypted private key deserialization
520-
- 2019-11-23 Update openssl/src/hash.rs
566+
- 2019-11-23 Update openssl/src/hash.rs
521567
- 2019-11-22 Add EVP_md_null() and MessageDigest::md_null()
522568
- 2019-11-22 Fix up base64 docs
523569
- 2019-11-22 Cleanup

boring-sys/Cargo.toml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,19 @@ features = ["rpk", "pq-experimental", "underscore-wildcards"]
5757
rustdoc-args = ["--cfg", "docsrs"]
5858

5959
[features]
60-
# Use a FIPS-validated version of boringssl.
60+
# Compile boringssl using the FIPS build flag if building boringssl from
61+
# scratch.
62+
#
63+
# See
64+
# https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md
65+
# for instructions and more details on the boringssl FIPS flag.
6166
fips = []
6267

68+
# Use a precompiled FIPS-validated version of BoringSSL. Meant to be used with
69+
# FIPS-20230428 or newer. Users must set `BORING_BSSL_FIPS_PATH` to use this
70+
# feature, or else the build will fail.
71+
fips-precompiled = []
72+
6373
# Link with precompiled FIPS-validated `bcm.o` module.
6474
fips-link-precompiled = []
6575

boring-sys/build/config.rs

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ pub(crate) struct Config {
1616

1717
pub(crate) struct Features {
1818
pub(crate) fips: bool,
19+
pub(crate) fips_precompiled: bool,
1920
pub(crate) fips_link_precompiled: bool,
2021
pub(crate) pq_experimental: bool,
2122
pub(crate) rpk: bool,
@@ -35,6 +36,7 @@ pub(crate) struct Env {
3536
pub(crate) android_ndk_home: Option<PathBuf>,
3637
pub(crate) cmake_toolchain_file: Option<PathBuf>,
3738
pub(crate) cpp_runtime_lib: Option<OsString>,
39+
pub(crate) docs_rs: bool,
3840
}
3941

4042
impl Config {
@@ -47,11 +49,7 @@ impl Config {
4749
let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap();
4850

4951
let features = Features::from_env();
50-
let env = Env::from_env(
51-
&host,
52-
&target,
53-
features.fips || features.fips_link_precompiled,
54-
);
52+
let env = Env::from_env(&host, &target, features.is_fips_like());
5553

5654
let mut is_bazel = false;
5755
if let Some(src_path) = &env.source_path {
@@ -80,6 +78,10 @@ impl Config {
8078
panic!("`fips` and `rpk` features are mutually exclusive");
8179
}
8280

81+
if self.features.fips_precompiled && self.features.rpk {
82+
panic!("`fips-precompiled` and `rpk` features are mutually exclusive");
83+
}
84+
8385
let is_precompiled_native_lib = self.env.path.is_some();
8486
let is_external_native_lib_source =
8587
!is_precompiled_native_lib && self.env.source_path.is_none();
@@ -96,30 +98,47 @@ impl Config {
9698
|| self.features.underscore_wildcards;
9799

98100
let patches_required = features_with_patches_enabled && !self.env.assume_patched;
99-
let build_from_sources_required = self.features.fips_link_precompiled || patches_required;
100101

101-
if is_precompiled_native_lib && build_from_sources_required {
102-
panic!("precompiled BoringSSL was provided, so FIPS configuration or optional patches can't be applied");
102+
if is_precompiled_native_lib && patches_required {
103+
println!(
104+
"cargo:warning=precompiled BoringSSL was provided, so patches will be ignored"
105+
);
106+
}
107+
108+
// todo(rmehra): should this even be a restriction? why not let people link a custom bcm.o?
109+
// precompiled boringssl will include libcrypto.a
110+
if is_precompiled_native_lib && self.features.fips_link_precompiled {
111+
panic!("precompiled BoringSSL was provided, so FIPS configuration can't be applied");
112+
}
113+
114+
if !is_precompiled_native_lib && self.features.fips_precompiled {
115+
panic!("`fips-precompiled` feature requires `BORING_BSSL_FIPS_PATH` to be set");
103116
}
104117
}
105118
}
106119

107120
impl Features {
108121
fn from_env() -> Self {
109122
let fips = env::var_os("CARGO_FEATURE_FIPS").is_some();
123+
let fips_precompiled = env::var_os("CARGO_FEATURE_FIPS_PRECOMPILED").is_some();
110124
let fips_link_precompiled = env::var_os("CARGO_FEATURE_FIPS_LINK_PRECOMPILED").is_some();
111125
let pq_experimental = env::var_os("CARGO_FEATURE_PQ_EXPERIMENTAL").is_some();
112126
let rpk = env::var_os("CARGO_FEATURE_RPK").is_some();
113127
let underscore_wildcards = env::var_os("CARGO_FEATURE_UNDERSCORE_WILDCARDS").is_some();
114128

115129
Self {
116130
fips,
131+
fips_precompiled,
117132
fips_link_precompiled,
118133
pq_experimental,
119134
rpk,
120135
underscore_wildcards,
121136
}
122137
}
138+
139+
pub(crate) fn is_fips_like(&self) -> bool {
140+
self.fips || self.fips_precompiled || self.fips_link_precompiled
141+
}
123142
}
124143

125144
impl Env {
@@ -133,9 +152,10 @@ impl Env {
133152
let target_var = |name: &str| {
134153
let kind = if host == target { "HOST" } else { "TARGET" };
135154

136-
var(&format!("{}_{}", name, target))
137-
.or_else(|| var(&format!("{}_{}", name, target_with_underscores)))
138-
.or_else(|| var(&format!("{}_{}", kind, name)))
155+
// TODO(rmehra): look for just `name` first, as most people just set that
156+
var(&format!("{name}_{target}"))
157+
.or_else(|| var(&format!("{name}_{target_with_underscores}")))
158+
.or_else(|| var(&format!("{kind}_{name}")))
139159
.or_else(|| var(name))
140160
};
141161

@@ -166,6 +186,7 @@ impl Env {
166186
android_ndk_home: target_var("ANDROID_NDK_HOME").map(Into::into),
167187
cmake_toolchain_file: target_var("CMAKE_TOOLCHAIN_FILE").map(Into::into),
168188
cpp_runtime_lib: target_var("BORING_BSSL_RUST_CPPLIB"),
189+
docs_rs: var("DOCS_RS").is_some(),
169190
}
170191
}
171192
}

0 commit comments

Comments
 (0)