Update boringssl-fips to fips-20220613 tag

.github/workflows/ci.yml

@@ -3,10 +3,10 @@ name: CI
 on:
   pull_request:
     branches:
-      - master
+      - teleport
   push:
     branches:
-      - master
+      - teleport
 
 env:
   RUSTFLAGS: -Dwarnings
@@ -17,7 +17,7 @@ jobs:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Install Rust
         run: rustup update stable && rustup default stable
       - name: Check formatting
@@ -27,16 +27,18 @@ jobs:
     name: clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
       - name: Install Rust
         run: rustup update stable && rustup default stable
       - name: Get rust version
         id: rust-version
         run: echo "::set-output name=version::$(rustc --version)"
+      - name: Install Ninja
+        uses: seanmiddleditch/gha-setup-ninja@v4
       - name: Cache cargo index
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
           path: ~/.cargo/registry/index
           key: index-${{ runner.os }}-${{ github.run_number }}
@@ -45,14 +47,14 @@ jobs:
       - name: Create lockfile
         run: cargo generate-lockfile
       - name: Cache cargo registry
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
           path: ~/.cargo/registry/cache
           key: registry-${{ runner.os }}-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.lock') }}
       - name: Fetch dependencies
         run: cargo fetch
       - name: Cache target directory
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
           path: target
           key: clippy-target-${{ runner.os }}-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.lock') }}
@@ -184,7 +186,7 @@ jobs:
           extra_test_args: --workspace --exclude tokio-boring --exclude hyper-boring
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
     - name: Install Rust (rustup)
@@ -238,20 +240,22 @@ jobs:
     name: Test FIPS integration
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
     - name: Install Rust (rustup)
       run: rustup update stable --no-self-update && rustup default stable
       shell: bash
-    - name: Install Clang-12
+    - name: Install Ninja
+      uses: seanmiddleditch/gha-setup-ninja@v4
+    - name: Install Clang-14
       uses: KyleMayes/install-llvm-action@v1
       with:
-        version: "12.0.0"
+        version: "14.0"
         directory: ${{ runner.temp }}/llvm
-    - name: Add clang++-12 link
+    - name: Add clang++-14 link
       working-directory: ${{ runner.temp }}/llvm/bin
-      run: ln -s clang clang++-12
+      run: ln -s clang clang++-14
     - name: Run tests
       run: cargo test --features fips
     - name: Test boring-sys cargo publish (FIPS)
@@ -275,7 +279,7 @@ jobs:
         include:
           - target: x86_64-unknown-linux-gnu
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
     - name: Install Rust (rustup)
@@ -299,20 +303,22 @@ jobs:
         include:
           - target: x86_64-unknown-linux-gnu
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
     - name: Install Rust (rustup)
       run: rustup update stable --no-self-update && rustup default stable && rustup target add ${{ matrix.target }}
       shell: bash
-    - name: Install Clang-12
+    - name: Install Ninja
+      uses: seanmiddleditch/gha-setup-ninja@v4
+    - name: Install Clang-14
       uses: KyleMayes/install-llvm-action@v1
       with:
-        version: "12.0.0"
+        version: "14.0"
         directory: ${{ runner.temp }}/llvm
-    - name: Add clang++-12 link
+    - name: Add clang++-14 link
       working-directory: ${{ runner.temp }}/llvm/bin
-      run: ln -s clang clang++-12
+      run: ln -s clang clang++-14
     - name: Install ${{ matrix.target }} toolchain
       run: brew tap messense/macos-cross-toolchains && brew install ${{ matrix.target }}
     - name: Set BORING_BSSL_FIPS_COMPILER_EXTERNAL_TOOLCHAIN
@@ -330,7 +336,7 @@ jobs:
     name: Test features
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: 'recursive'
     - name: Install Rust (rustup)
@@ -340,7 +346,15 @@ jobs:
       name: Run `rpk` tests
     - run: cargo test --features pq-experimental
       name: Run `pq-experimental` tests
+    - run: cargo test --features underscore-wildcards
+      name: Run `underscore-wildcards` tests
     - run: cargo test --features pq-experimental,rpk
       name: Run `pq-experimental,rpk` tests
     - run: cargo test --features kx-safe-default,pq-experimental
       name: Run `kx-safe-default` tests
+    - run: cargo test --features pq-experimental,underscore-wildcards
+      name: Run `pq-experimental,underscore-wildcards` tests
+    - run: cargo test --features rpk,underscore-wildcards
+      name: Run `rpk,underscore-wildcards` tests
+    - run: cargo test --features pq-experimental,rpk,underscore-wildcards
+      name: Run `pq-experimental,rpk,underscore-wildcards` tests

.github/workflows/dependency-review.yaml

@@ -0,0 +1,12 @@
+name: Dependency Review
+
+on:
+  pull_request:
+  merge_group:
+
+jobs:
+  dependency-review:
+    uses: gravitational/shared-workflows/.github/workflows/dependency-review.yaml@main
+    permissions:
+      contents: read
+      pull-requests: write

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "4.2.0"
+version = "4.4.0"
 repository = "https://github.com/cloudflare/boring"
 edition = "2021"
 
@@ -19,9 +19,9 @@ tag-prefix = ""
 publish = false
 
 [workspace.dependencies]
-boring-sys = { version = "4.2.0", path = "./boring-sys" }
-boring = { version = "4.2.0", path = "./boring" }
-tokio-boring = { version = "4.2.0", path = "./tokio-boring" }
+boring-sys = { version = "4.4.0", path = "./boring-sys" }
+boring = { version = "4.4.0", path = "./boring" }
+tokio-boring = { version = "4.4.0", path = "./tokio-boring" }
 
 bindgen = { version = "0.68.1", default-features = false, features = ["runtime"] }
 cmake = "0.1.18"
@@ -40,4 +40,5 @@ http = "0.2"
 hyper = { version = "0.14", default-features = false }
 linked_hash_set = "0.1"
 once_cell = "1.0"
+tower = "0.4"
 tower-layer = "0.3"

boring-sys/Cargo.toml

@@ -51,7 +51,7 @@ include = [
 ]
 
 [package.metadata.docs.rs]
-features = ["rpk", "pq-experimental"]
+features = ["rpk", "pq-experimental", "underscore-wildcards"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -71,6 +71,11 @@ rpk = []
 # can be provided by setting `BORING_BSSL{,_FIPS}_SOURCE_PATH`.
 pq-experimental = []
 
+# Applies a patch (`patches/underscore-wildcards.patch`) to enable
+# `ffi::X509_CHECK_FLAG_UNDERSCORE_WILDCARDS`. Same caveats as
+# those for `pq-experimental` feature apply.
+underscore-wildcards = []
+
 [build-dependencies]
 bindgen = { workspace = true }
 cmake = { workspace = true }