Skip to content

Conversation

gwynne
Copy link
Contributor

@gwynne gwynne commented Sep 8, 2025

Fix multiple issues in the BoringSSL vendoring script and update BoringSSL to 0226f30467f540a3f62ef48d453f93927da199b6

Checklist

  • I've run tests to see all new and existing tests pass
  • I've followed the code style of the rest of the project
  • I've read the Contribution Guidelines
  • I've updated the documentation if necessary

Motivation:

The vendor-boringssl.sh script is currently broken in a number of
ways, both in general and relative to the latest BoringSSL version:

  • --enable-test-discovery is still in use
  • The Linux Swift SDKs being generated are out of date (5.10-jammy)
  • The script does not prefix exported C++ symbols
  • Invoking the script without a BORINGSSL_REVISION results in an
    unconditional error
  • The PATTERNS list is out of date for the latest BoringSSL
  • The latest BoringSSL contains a bug which fails to apply extern "C"
    to two exported symbols, allowing for collisions.

In addition, the latest BoringSSL has made BN_MONT_CTX opaque,
necessitating that it be referenced with OpaquePointer rather than
UnsafePointer<>.

Modifications:

The following changes are included:

  • --enable-test-discovery has been removed
  • vendor-boringssl.sh and generate-linux-sdks.sh have been updated
    to use Swift 6.1.2 SDKs built for Ubuntu Noble
  • The mangle_cpp_structures function from swift-nio-ssl's version
    of vendor-boringssl.sh has been copied over (thanks @Lukasa!)
  • BORINGSSL_REVISION is now allowed to be an empty string
  • The PATTERNS array has been updated
  • A patch has been added which applies extern "C" to the functions
    which should have it
  • s/UnsafePointer<BN_MONT_CTX>/OpaquePointer/g
  • Updated CMakeLists.txt per update-cmake-lists.sh
  • Update BoringSSL to
    0226f30467f540a3f62ef48d453f93927da199b6

Result:

Vendoring the latest BoringSSL will work again.
The latest BoringSSL is vendored.

Motivation:

The `vendor-boringssl.sh` script is currently broken in a number of
ways, both in general and relative to the latest BoringSSL version:

- `--enable-test-discovery` is still in use
- The Linux Swift SDKs being generated are out of date (5.10-jammy)
- The script does not prefix exported C++ symbols
- Invoking the script without a `BORINGSSL_REVISION` results in an
unconditional error
- The `PATTERNS` list is out of date for the latest BoringSSL
- The latest BoringSSL contains a bug which fails to apply `extern "C"`
to two exported symbols, allowing for collisions.

In addition, the latest BoringSSL has made `BN_MONT_CTX` opaque,
necessitating that it be referenced with `OpaquePointer` rather than
`UnsafePointer<>`.

Modifications:

The following changes are included:

- `--enable-test-discovery` has been removed
- `vendor-boringssl.sh` and `generate-linux-sdks.sh` have been updated
to use Swift 6.1.2 SDKs built for Ubuntu Noble
- The `mangle_cpp_structures` function from `swift-nio-ssl`'s version
of `vendor-boringssl.sh` has been copied over (thanks @Lukasa!)
- `BORINGSSL_REVISION` is now allowed to be an empty string
- The `PATTERNS` array has been updated
- A patch has been added which applies `extern "C"` to the functions
which should have it
- `s/UnsafePointer<BN_MONT_CTX>/OpaquePointer/g`

Result:

Vendoring the latest BoringSSL will work again.
This patch updates BoringSSL to
0226f30467f540a3f62ef48d453f93927da199b6.

As with all of our patch updates to BoringSSL, this comes in multiple
commits. The first contains the changes to the vendoring script and
the tweaks to product code.
@Lukasa Lukasa added the 🔨 semver/patch No public API change. label Sep 11, 2025
@gwynne gwynne force-pushed the fix-vendoring-and-update-boringssl branch from 9e35463 to 4b21257 Compare September 11, 2025 15:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🔨 semver/patch No public API change.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants