Repository navigation
Conversation
panva
added
tls
Collaborator
|
Review requested:
|
nodejs-github-bot
added
lib / src
This comment was marked as outdated.
This comment was marked as outdated.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #66922 +/- ##
==========================================
+ Coverage 89.96% 90.57% +0.61%
==========================================
Files 797 797
Lines 278494 278505 +11
Branches 53411 53538 +127
==========================================
+ Hits 250540 252262 +1722
+ Misses 18184 16579 -1605
+ Partials 9770 9664 -106
🚀 New features to boost your workflow:
|
Use BoringSSL 0.20261020.0 for shared-library builds and expose the package wrapper's version to the matrix updater. The new verifier no longer emits UNABLE_TO_VERIFY_LEAF_SIGNATURE after Node's verification callback accepts a missing-issuer error. Expect UNABLE_TO_GET_ISSUER_CERT_LOCALLY for the affected leaf certificates and suggest --use-system-ca for that error. Drop the SSL_get_server_tmp_key() fallback now that BoringSSL supplies SSL_get_peer_tmp_key() as a compatibility stub. Refs: https://boringssl-review.googlesource.com/c/boringssl/+/103849 Refs: electron/electron@b457e70 Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
Add SHA3-256, SHA3-384, and SHA3-512 to name lookup and getHashes(). BoringSSL exposes EVP_sha3_* descriptors but omits them from its digest registry. Map the names directly to those descriptors so node:crypto can use them too. When using BoringSSL, limit WebCrypto SHA-3 support to digest operations. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
Translate cipher-suite names into protocol IDs for BoringSSL's TLS 1.3 configuration API. Handle duplicates and unknown names, reject nonempty lists without a supported suite, and implement honorCipherOrder through preference flags. Cover suite restrictions, explicit preference ordering, legacy-only lists, runtime defaults, and command-line overrides. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
Run supported DH, ECDH, legacy TLS, TLS 1.2 PSK, cipher metadata, raw key, and X.509 date cases with BoringSSL. Assert its DH flags, curve format errors, and name-constraint behavior. Narrow key/cert array exclusions to the failing multi-identity cases. Use modp5 for the DH group setter checks and remove the unused legacy protocol fallback helper. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
panva
force-pushed
the
boringssl-refresh
branch
from
October 22, 2026 12:59
f699212 to
c76790a
Compare
Contributor
Changelog@@ -107,12 +107,12 @@
-/nix/store/1kz13kf8hpvib8py2bwk9cz4rww084pj-boringssl-0.20260929.0 (aarch64-darwin)
-/nix/store/9qnmqyy3a96cxixkh5012vmdx7mmj8mn-boringssl-0.20260929.0 (aarch64-darwin)
-/nix/store/2vs0ylgshc4r3wvg9r4mdc1vzvj657a3-boringssl-0.20260929.0 (aarch64-linux)
-/nix/store/dqa82pf6zpbya2q5j5y27vqqrw79433a-boringssl-0.20260929.0 (aarch64-linux)
-/nix/store/50qpspny60wkd3n1s34mjj9hphp8lznj-boringssl-0.20260929.0 (x86_64-linux)
-/nix/store/ddvwnb04q65yd67zbv2n9983iir5yjwy-boringssl-0.20260929.0 (x86_64-linux)
-/nix/store/ripv3j3z8rq4nwzjp5avrdgr0h98dq4f-boringssl-0.20260929.0-bin (aarch64-darwin)
-/nix/store/8l13y89lh31qh05k4svx36kga52qpahr-boringssl-0.20260929.0-bin (aarch64-linux)
-/nix/store/l7l8zk0fgvcgciy0hdr6f4bxxn5gqhsx-boringssl-0.20260929.0-bin (x86_64-linux)
-/nix/store/vf8mvwr778rk7a8ii5ykjjbybmq8v8xq-boringssl-0.20260929.0-dev (aarch64-darwin)
-/nix/store/lhg2ws49qminj9ib132airsyb27ybl85-boringssl-0.20260929.0-dev (aarch64-linux)
-/nix/store/qfkyfg83vrhrhdlhw68z3rh3qzspva68-boringssl-0.20260929.0-dev (x86_64-linux)
+/nix/store/la0w0vyk0wpzyv3i2c0wiqdggjqx1vby-boringssl-0.20261020.0 (aarch64-darwin)
+/nix/store/w7nxxrjnypjbb64va1hfhdxn7b1y2x18-boringssl-0.20261020.0 (aarch64-darwin)
+/nix/store/cxzbln2ank856srbqbdpbdljjxyjjmd8-boringssl-0.20261020.0 (aarch64-linux)
+/nix/store/pcd93bv8a8sggy48pnj44hwn2938x685-boringssl-0.20261020.0 (aarch64-linux)
+/nix/store/52zl4z8025h6dij4wsx49896kw1clckz-boringssl-0.20261020.0 (x86_64-linux)
+/nix/store/q0ayjr9fwdf23wkzcbjdn1h6km11jgjm-boringssl-0.20261020.0 (x86_64-linux)
+/nix/store/nk67q3idl5vh4m1wnyb5mykr24s6787h-boringssl-0.20261020.0-bin (aarch64-darwin)
+/nix/store/92clk0vn1xy8m746m5sl7gpv81kq1yfj-boringssl-0.20261020.0-bin (aarch64-linux)
+/nix/store/qvc37vwnpm7jql42awzx3xb1akckg482-boringssl-0.20261020.0-bin (x86_64-linux)
+/nix/store/hcb9grrnc45kk19c7j4p42n6lm5r2gk4-boringssl-0.20261020.0-dev (aarch64-darwin)
+/nix/store/ay5w1l4svy28yz4cc3k7y17jwmqqn4hx-boringssl-0.20261020.0-dev (aarch64-linux)
+/nix/store/p92scpq9586m4h866vj8wh9vkicd61b0-boringssl-0.20261020.0-dev (x86_64-linux) |
aduh95
approved these changes
Oct 22, 2026
aduh95
left a comment
aduh95
left a comment
Contributor
There was a problem hiding this comment.
Nix changes LGTM, the rest RSLGTM
panva
added
author ready
github-actions
Bot
removed
the
request-ci
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the BoringSSL pin used by shared-library CI to 0.20261020.0, adjust TLS certificate error expectations and the system CA hint, and remove the obsolete temporary-key compatibility shim.
Wire up SHA-3 to
node:cryptoandsubtle.digest()when built with/linked to BoringSSL. Limit WebCrypto SHA-3 support to digest operations when using BoringSSL (because it's not universally supported as a hash member of all algorithms).Wire up TLS 1.3 cipher configuration and
honorCipherOrderwith BoringSSL, using native backend defaults for legacy-only cipher lists. Remove obsolete test exclusions and narrow broad skips to recover supported crypto and TLS coverage.