Update BoringSSL to 0226f30467f540a3f62ef48d453f93927da199b6 #406
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Motivation: The `vendor-boringssl.sh` script is currently broken in a number of ways, both in general and relative to the latest BoringSSL version: - `--enable-test-discovery` is still in use - The Linux Swift SDKs being generated are out of date (5.10-jammy) - The script does not prefix exported C++ symbols - Invoking the script without a `BORINGSSL_REVISION` results in an unconditional error - The `PATTERNS` list is out of date for the latest BoringSSL - The latest BoringSSL contains a bug which fails to apply `extern "C"` to two exported symbols, allowing for collisions. In addition, the latest BoringSSL has made `BN_MONT_CTX` opaque, necessitating that it be referenced with `OpaquePointer` rather than `UnsafePointer<>`. Modifications: The following changes are included: - `--enable-test-discovery` has been removed - `vendor-boringssl.sh` and `generate-linux-sdks.sh` have been updated to use Swift 6.1.2 SDKs built for Ubuntu Noble - The `mangle_cpp_structures` function from `swift-nio-ssl`'s version of `vendor-boringssl.sh` has been copied over (thanks @Lukasa!) - `BORINGSSL_REVISION` is now allowed to be an empty string - The `PATTERNS` array has been updated - A patch has been added which applies `extern "C"` to the functions which should have it - `s/UnsafePointer<BN_MONT_CTX>/OpaquePointer/g` Result: Vendoring the latest BoringSSL will work again.
This patch updates BoringSSL to 0226f30467f540a3f62ef48d453f93927da199b6. As with all of our patch updates to BoringSSL, this comes in multiple commits. The first contains the changes to the vendoring script and the tweaks to product code.
gwynne
force-pushed
the
fix-vendoring-and-update-boringssl
branch
from
9e35463 to
4b21257
Compare
Lukasa
approved these changes
Sep 15, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix multiple issues in the BoringSSL vendoring script and update BoringSSL to 0226f30467f540a3f62ef48d453f93927da199b6
Checklist
Motivation:
The
vendor-boringssl.shscript is currently broken in a number ofways, both in general and relative to the latest BoringSSL version:
--enable-test-discoveryis still in useBORINGSSL_REVISIONresults in anunconditional error
PATTERNSlist is out of date for the latest BoringSSLextern "C"to two exported symbols, allowing for collisions.
In addition, the latest BoringSSL has made
BN_MONT_CTXopaque,necessitating that it be referenced with
OpaquePointerrather thanUnsafePointer<>.Modifications:
The following changes are included:
--enable-test-discoveryhas been removedvendor-boringssl.shandgenerate-linux-sdks.shhave been updatedto use Swift 6.1.2 SDKs built for Ubuntu Noble
mangle_cpp_structuresfunction fromswift-nio-ssl's versionof
vendor-boringssl.shhas been copied over (thanks @Lukasa!)BORINGSSL_REVISIONis now allowed to be an empty stringPATTERNSarray has been updatedextern "C"to the functionswhich should have it
s/UnsafePointer<BN_MONT_CTX>/OpaquePointer/gCMakeLists.txtperupdate-cmake-lists.sh0226f30467f540a3f62ef48d453f93927da199b6Result:
Vendoring the latest BoringSSL will work again.
The latest BoringSSL is vendored.