GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — crypto: remove obsolete BoringSSL shims and use available APIs by panva · Pull Request #65423 · nodejs/node

Conversation

@panva

@panva panva commented Aug 20, 2026

Copy link
Copy Markdown
Member

Use BoringSSL's current RSA and DH validation results instead of maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level through BoringSSL's compatibility APIs.

BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused since #64827 and require the fixed ML-KEM private-key import error.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
panva added 2 commits August 20, 2026 12:27
@panva
crypto: remove obsolete BoringSSL shims
20c21a5
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <[email protected]>
@panva
crypto: use available BoringSSL APIs
932b0fc
Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <[email protected]>
@nodejs-github-bot

nodejs-github-bot commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/security-wg
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@panva panva added the commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. label Aug 20, 2026
@nodejs-github-bot nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Aug 20, 2026
@panva panva added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. labels Aug 20, 2026
pimterry
pimterry approved these changes Aug 20, 2026
View reviewed changes
@pimterry pimterry added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 20, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 20, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@panva panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. and removed dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Aug 20, 2026
aduh95
aduh95 reviewed Aug 20, 2026
View reviewed changes
Comment thread deps/ncrypto/ncrypto.h Resolved

Uh oh!

There was an error while loading. Please reload this page.

@panva
fixup! crypto: use available BoringSSL APIs
60d2e08
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@codecov

codecov Bot commented Aug 20, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.12%. Comparing base (fd5b135) to head (60d2e08).
⚠️ Report is 45 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #65423      +/-   ##
==========================================
- Coverage   90.12%   90.12%   -0.01%     
==========================================
  Files         752      752              
  Lines      252325   252321       -4     
  Branches    47456    47464       +8     
==========================================
- Hits       227407   227398       -9     
+ Misses      16217    16211       -6     
- Partials     8701     8712      +11     
Files with missing lines Coverage Δ
src/crypto/crypto_dh.cc 65.97% <ø> (ø)
src/crypto/crypto_rsa.cc 63.87% <ø> (ø)

... and 32 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nodejs-github-bot

nodejs-github-bot commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/76124/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@panva
panva requested a review from aduh95 August 21, 2026 23:26
aduh95
aduh95 approved these changes Aug 22, 2026
View reviewed changes
@panva panva added the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 22, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 22, 2026

Copy link
Copy Markdown
Collaborator

Landed in e573bd6...30fe871

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot pushed a commit that referenced this pull request Aug 22, 2026
@panva @nodejs-github-bot
crypto: remove obsolete BoringSSL shims
148b6cd
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
nodejs-github-bot pushed a commit that referenced this pull request Aug 22, 2026
@panva @nodejs-github-bot
crypto: use available BoringSSL APIs
30fe871
Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
@nodejs-github-bot nodejs-github-bot closed this Aug 22, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 22, 2026
@panva
panva deleted the boringssl-cleanup branch August 22, 2026 10:56
@panva panva mentioned this pull request Aug 22, 2026
[v26.x backport] crypto: remove obsolete BoringSSL shims and use available APIs #65483
Closed
@panva panva added the backport-open-v26.x Indicate that the PR has an open backport label Aug 22, 2026
panva added a commit to panva/node that referenced this pull request Aug 23, 2026
@panva
crypto: remove obsolete BoringSSL shims
6c87d4f
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#65423
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
panva added a commit to panva/node that referenced this pull request Aug 23, 2026
@panva
crypto: use available BoringSSL APIs
bc52379
Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs#65423
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@panva @aduh95
crypto: remove obsolete BoringSSL shims
9e92114
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Backport-PR-URL: #65483
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@panva @aduh95
crypto: use available BoringSSL APIs
62d3602
Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Backport-PR-URL: #65483
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
@panva panva added backported-to-v26.x PRs backported to the v26.x-staging branch. and removed backport-open-v26.x Indicate that the PR has an open backport labels Aug 25, 2026
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@panva @aduh95
crypto: remove obsolete BoringSSL shims
0e87576
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Backport-PR-URL: #65483
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@panva @aduh95
crypto: use available BoringSSL APIs
137ff67
Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Backport-PR-URL: #65483
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
@github-actions github-actions Bot mentioned this pull request Aug 25, 2026
2026-08-26, Version 26.8.0 (Current) #65551
Merged
aduh95 pushed a commit that referenced this pull request Aug 27, 2026
@panva @aduh95
crypto: remove obsolete BoringSSL shims
a9bd780
BoringSSL implements OPENSSL_zalloc and BN_secure_new and provides
compatible secure heap status stubs. Use the common code paths.

Remove ClientHello helpers left unused by the early callback migration
and require the fixed ML-KEM private-key import error.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Backport-PR-URL: #65483
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 27, 2026
@panva @aduh95
crypto: use available BoringSSL APIs
8029383
Use BoringSSL's current RSA and DH validation results instead of
maintaining backend-specific prechecks and collapsing key errors.

Report negotiated TLS groups and the documented zero security level
through BoringSSL's compatibility APIs.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #65423
Backport-PR-URL: #65483
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
@github-actions github-actions Bot mentioned this pull request Sep 7, 2026
2026-09-08, Version 24.21.0 'Krypton' (LTS) #65873
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pimterry pimterry pimterry approved these changes
@aduh95 aduh95 aduh95 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. backported-to-v26.x PRs backported to the v26.x-staging branch. commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@panva @nodejs-github-bot @pimterry @aduh95
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.