refresh expired tls test certificates

boring-sys/build/main.rs

@@ -394,7 +394,7 @@ fn get_boringssl_cmake_config(config: &Config) -> cmake::Config {
 }
 
 fn pick_best_android_ndk_toolchain(toolchains_dir: &Path) -> io::Result<OsString> {
-    let toolchains = std::fs::read_dir(toolchains_dir)?.collect::<Result<Vec<_>, _>>()?;
+    let toolchains = fs::read_dir(toolchains_dir)?.collect::<Result<Vec<_>, _>>()?;
     // First look for one of the toolchains that Google has documented.
     // https://developer.android.com/ndk/guides/other_build_systems
     for known_toolchain in ["linux-x86_64", "darwin-x86_64", "windows-x86_64"] {
@@ -414,8 +414,8 @@ fn pick_best_android_ndk_toolchain(toolchains_dir: &Path) -> io::Result<OsString
         return Ok(toolchain.file_name());
     }
     // Finally give up.
-    Err(std::io::Error::new(
-        std::io::ErrorKind::NotFound,
+    Err(io::Error::new(
+        io::ErrorKind::NotFound,
         "no subdirectories at given path",
     ))
 }
@@ -569,8 +569,8 @@ fn run_command(command: &mut Command) -> io::Result<Output> {
         )
     })?;
 
-    std::io::stderr().write_all(&out.stderr)?;
-    std::io::stdout().write_all(&out.stdout)?;
+    io::stderr().write_all(&out.stderr)?;
+    io::stdout().write_all(&out.stdout)?;
 
     if !out.status.success() {
         let err = match out.status.code() {

boring-sys/src/lib.rs

@@ -19,7 +19,8 @@ use std::os::raw::{c_char, c_int, c_uint, c_ulong};
     clippy::useless_transmute,
     clippy::derive_partial_eq_without_eq,
     clippy::ptr_offset_with_cast,
-    dead_code
+    dead_code,
+    unnecessary_transmutes
 )]
 mod generated {
     include!(concat!(env!("OUT_DIR"), "/bindings.rs"));

boring/src/hash.rs

@@ -387,7 +387,6 @@ pub(crate) fn hmac<const N: usize>(
 #[cfg(test)]
 mod tests {
     use hex::{self, FromHex};
-    use std::io::prelude::*;
 
     use super::*;
 

boring/src/rsa.rs

@@ -673,9 +673,9 @@ mod test {
 
     #[test]
     fn test_private_encrypt() {
-        let k0 = super::Rsa::generate(512).unwrap();
+        let k0 = Rsa::generate(512).unwrap();
         let k0pkey = k0.public_key_to_pem().unwrap();
-        let k1 = super::Rsa::public_key_from_pem(&k0pkey).unwrap();
+        let k1 = Rsa::public_key_from_pem(&k0pkey).unwrap();
 
         let msg = vec![0xdeu8, 0xadu8, 0xd0u8, 0x0du8];
 
@@ -691,9 +691,9 @@ mod test {
 
     #[test]
     fn test_public_encrypt() {
-        let k0 = super::Rsa::generate(512).unwrap();
+        let k0 = Rsa::generate(512).unwrap();
         let k0pkey = k0.private_key_to_pem().unwrap();
-        let k1 = super::Rsa::private_key_from_pem(&k0pkey).unwrap();
+        let k1 = Rsa::private_key_from_pem(&k0pkey).unwrap();
 
         let msg = vec![0xdeu8, 0xadu8, 0xd0u8, 0x0du8];
 
@@ -721,24 +721,24 @@ mod test {
 
     #[test]
     fn test_public_key_to_pem_pkcs1() {
-        let keypair = super::Rsa::generate(512).unwrap();
+        let keypair = Rsa::generate(512).unwrap();
         let pubkey_pem = keypair.public_key_to_pem_pkcs1().unwrap();
-        super::Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
+        Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
     }
 
     #[test]
     #[should_panic]
     fn test_public_key_from_pem_pkcs1_generate_panic() {
-        let keypair = super::Rsa::generate(512).unwrap();
+        let keypair = Rsa::generate(512).unwrap();
         let pubkey_pem = keypair.public_key_to_pem().unwrap();
-        super::Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
+        Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
     }
 
     #[test]
     fn test_pem_pkcs1_encrypt() {
-        let keypair = super::Rsa::generate(2048).unwrap();
+        let keypair = Rsa::generate(2048).unwrap();
         let pubkey_pem = keypair.public_key_to_pem_pkcs1().unwrap();
-        let pubkey = super::Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
+        let pubkey = Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
         let msg = b"Hello, world!";
 
         let mut encrypted = vec![0; pubkey.size() as usize];
@@ -756,9 +756,9 @@ mod test {
 
     #[test]
     fn test_pem_pkcs1_padding() {
-        let keypair = super::Rsa::generate(2048).unwrap();
+        let keypair = Rsa::generate(2048).unwrap();
         let pubkey_pem = keypair.public_key_to_pem_pkcs1().unwrap();
-        let pubkey = super::Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
+        let pubkey = Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
         let msg = b"foo";
 
         let mut encrypted1 = vec![0; pubkey.size() as usize];

boring/src/ssl/error.rs

@@ -251,7 +251,7 @@ fn fmt_mid_handshake_error(
     prefix: &str,
 ) -> fmt::Result {
     if !s.ssl().ssl_context().has_x509_support() {
-        write!(f, "{}", prefix)?;
+        write!(f, "{prefix}")?;
         return write!(f, " {}", s.error());
     }
 

boring/src/ssl/test/cert_verify.rs

@@ -61,8 +61,8 @@ fn callback_receives_correct_certificate() {
     // but client doesn't load the root as trusted.
     // So we expect an error.
     let mut client = server.client();
-    let leaf_sha1 = "59172d9313e84459bcff27f967e79e6e9217e584";
-    let root_sha1 = "c0cbdf7cdd03c9773e5468e1f6d2da7d5cbb1875";
+    let leaf_sha1 = "585e3a58acfd3b4e5e2825659407244ddd93539c";
+    let root_sha1 = "1b1ad6250902865aea72bc1e843d45b769e6c553";
     client.ctx().set_verify(SslVerifyMode::PEER);
     client.ctx().set_cert_verify_callback(move |x509| {
         assert!(!x509.verify_cert().unwrap());
@@ -110,8 +110,8 @@ fn callback_receives_correct_certificate() {
 fn callback_receives_correct_chain() {
     let server = Server::builder().build();
     let mut client = server.client_with_root_ca();
-    let leaf_sha1 = "59172d9313e84459bcff27f967e79e6e9217e584";
-    let root_sha1 = "c0cbdf7cdd03c9773e5468e1f6d2da7d5cbb1875";
+    let leaf_sha1 = "585e3a58acfd3b4e5e2825659407244ddd93539c";
+    let root_sha1 = "1b1ad6250902865aea72bc1e843d45b769e6c553";
     client.ctx().set_verify(SslVerifyMode::PEER);
     client.ctx().set_cert_verify_callback(move |x509| {
         assert!(x509.verify_cert().unwrap());

boring/src/ssl/test/custom_verify.rs

@@ -151,7 +151,7 @@ fn callback() {
     static CALLED_BACK: AtomicBool = AtomicBool::new(false);
     let server = Server::builder().build();
     let mut client = server.client();
-    let expected = "59172d9313e84459bcff27f967e79e6e9217e584";
+    let expected = super::TEST_CERT_DIGEST;
 
     client
         .ctx()
@@ -181,7 +181,7 @@ fn ssl_callback() {
     static CALLED_BACK: AtomicBool = AtomicBool::new(false);
     let server = Server::builder().build();
     let mut client = server.client().build().builder();
-    let expected = "59172d9313e84459bcff27f967e79e6e9217e584";
+    let expected = super::TEST_CERT_DIGEST;
 
     client
         .ssl()
@@ -219,7 +219,7 @@ fn both_callback() {
         });
 
     let mut client = client.build().builder();
-    let expected = "59172d9313e84459bcff27f967e79e6e9217e584";
+    let expected = super::TEST_CERT_DIGEST;
 
     client
         .ssl()

boring/src/ssl/test/mod.rs

@@ -37,6 +37,7 @@ mod verify;
 static ROOT_CERT: &[u8] = include_bytes!("../../../test/root-ca.pem");
 static CERT: &[u8] = include_bytes!("../../../test/cert.pem");
 static KEY: &[u8] = include_bytes!("../../../test/key.pem");
+const TEST_CERT_DIGEST: &str = "585e3a58acfd3b4e5e2825659407244ddd93539c";
 
 #[test]
 fn get_ctx_options() {
@@ -75,10 +76,7 @@ fn peer_certificate() {
     let s = server.client().connect();
     let cert = s.ssl().peer_certificate().unwrap();
     let fingerprint = cert.digest(MessageDigest::sha1()).unwrap();
-    assert_eq!(
-        hex::encode(fingerprint),
-        "59172d9313e84459bcff27f967e79e6e9217e584"
-    );
+    assert_eq!(hex::encode(fingerprint), TEST_CERT_DIGEST);
 }
 
 #[test]

boring/src/ssl/test/verify.rs

@@ -112,7 +112,7 @@ fn callback() {
     let server = Server::builder().build();
 
     let mut client = server.client();
-    let expected = "59172d9313e84459bcff27f967e79e6e9217e584";
+    let expected = super::TEST_CERT_DIGEST;
     client
         .ctx()
         .set_verify_callback(SslVerifyMode::PEER, move |_, x509| {
@@ -134,7 +134,7 @@ fn ssl_callback() {
     let server = Server::builder().build();
 
     let mut client = server.client().build().builder();
-    let expected = "59172d9313e84459bcff27f967e79e6e9217e584";
+    let expected = super::TEST_CERT_DIGEST;
     client
         .ssl()
         .set_verify_callback(SslVerifyMode::PEER, move |_, x509| {

boring/src/stack.rs

@@ -4,7 +4,6 @@ use libc::size_t;
 use std::borrow::Borrow;
 use std::convert::AsRef;
 use std::fmt;
-use std::iter;
 use std::marker::PhantomData;
 use std::mem;
 use std::ops::{Deref, DerefMut, Index, IndexMut, Range};
@@ -63,7 +62,7 @@ impl<T: Stackable> Stack<T> {
     }
 }
 
-impl<T: Stackable> iter::IntoIterator for Stack<T> {
+impl<T: Stackable> IntoIterator for Stack<T> {
     type IntoIter = IntoIter<T>;
     type Item = T;
 
@@ -271,7 +270,7 @@ impl<T: Stackable> IndexMut<usize> for StackRef<T> {
     }
 }
 
-impl<'a, T: Stackable> iter::IntoIterator for &'a StackRef<T> {
+impl<'a, T: Stackable> IntoIterator for &'a StackRef<T> {
     type Item = &'a T::Ref;
     type IntoIter = Iter<'a, T>;
 
@@ -280,7 +279,7 @@ impl<'a, T: Stackable> iter::IntoIterator for &'a StackRef<T> {
     }
 }
 
-impl<'a, T: Stackable> iter::IntoIterator for &'a mut StackRef<T> {
+impl<'a, T: Stackable> IntoIterator for &'a mut StackRef<T> {
     type Item = &'a mut T::Ref;
     type IntoIter = IterMut<'a, T>;
 
@@ -289,7 +288,7 @@ impl<'a, T: Stackable> iter::IntoIterator for &'a mut StackRef<T> {
     }
 }
 
-impl<'a, T: Stackable> iter::IntoIterator for &'a Stack<T> {
+impl<'a, T: Stackable> IntoIterator for &'a Stack<T> {
     type Item = &'a T::Ref;
     type IntoIter = Iter<'a, T>;
 
@@ -298,7 +297,7 @@ impl<'a, T: Stackable> iter::IntoIterator for &'a Stack<T> {
     }
 }
 
-impl<'a, T: Stackable> iter::IntoIterator for &'a mut Stack<T> {
+impl<'a, T: Stackable> IntoIterator for &'a mut Stack<T> {
     type Item = &'a mut T::Ref;
     type IntoIter = IterMut<'a, T>;
 

boring/src/x509/mod.rs

@@ -723,7 +723,7 @@ impl X509Ref {
                 host.as_ptr().cast(),
                 host.len(),
                 0,
-                std::ptr::null_mut(),
+                ptr::null_mut(),
             ))
             .map(|n| n == 1)
         }
@@ -832,9 +832,9 @@ impl fmt::Debug for X509 {
         let serial = match &self.serial_number().to_bn() {
             Ok(bn) => match bn.to_hex_str() {
                 Ok(hex) => hex.to_string(),
-                Err(_) => "".to_string(),
+                Err(_) => String::new(),
             },
-            Err(_) => "".to_string(),
+            Err(_) => String::new(),
         };
         let mut debug_struct = formatter.debug_struct("X509");
         debug_struct.field("serial_number", &serial);

boring/src/x509/tests/mod.rs

@@ -13,6 +13,7 @@ use crate::x509::extension::{
 };
 use crate::x509::store::X509StoreBuilder;
 use crate::x509::{X509Extension, X509Name, X509Req, X509StoreContext, X509};
+const TEST_CERT_DIGEST: &str = "585e3a58acfd3b4e5e2825659407244ddd93539c";
 
 mod trusted_first;
 
@@ -27,8 +28,7 @@ fn test_cert_loading() {
     let cert = X509::from_pem(cert).unwrap();
     let fingerprint = cert.digest(MessageDigest::sha1()).unwrap();
 
-    let hash_str = "59172d9313e84459bcff27f967e79e6e9217e584";
-    let hash_vec = Vec::from_hex(hash_str).unwrap();
+    let hash_vec = Vec::from_hex(TEST_CERT_DIGEST).unwrap();
 
     assert_eq!(hash_vec, &*fingerprint);
 }
@@ -43,8 +43,8 @@ fn test_debug() {
     assert!(debugged.contains(r#"signature_algorithm: sha256WithRSAEncryption"#));
     assert!(debugged.contains(r#"countryName = "AU""#));
     assert!(debugged.contains(r#"stateOrProvinceName = "Some-State""#));
-    assert!(debugged.contains(r#"not_before: Aug 14 17:00:03 2016 GMT"#));
-    assert!(debugged.contains(r#"not_after: Aug 12 17:00:03 2026 GMT"#));
+    assert!(debugged.contains(r#"not_before: Aug 12 21:37:58 2026 GMT"#));
+    assert!(debugged.contains(r#"not_after: Aug  9 21:37:58 2036 GMT"#));
 }
 
 #[test]
@@ -54,8 +54,8 @@ fn test_cert_issue_validity() {
     let not_before = cert.not_before().to_string();
     let not_after = cert.not_after().to_string();
 
-    assert_eq!(not_before, "Aug 14 17:00:03 2016 GMT");
-    assert_eq!(not_after, "Aug 12 17:00:03 2026 GMT");
+    assert_eq!(not_before, "Aug 12 21:37:58 2026 GMT");
+    assert_eq!(not_after, "Aug  9 21:37:58 2036 GMT");
 }
 
 #[test]
@@ -395,11 +395,11 @@ fn test_stack_from_pem() {
     assert_eq!(certs.len(), 2);
     assert_eq!(
         hex::encode(certs[0].digest(MessageDigest::sha1()).unwrap()),
-        "59172d9313e84459bcff27f967e79e6e9217e584"
+        "585e3a58acfd3b4e5e2825659407244ddd93539c"
     );
     assert_eq!(
         hex::encode(certs[1].digest(MessageDigest::sha1()).unwrap()),
-        "c0cbdf7cdd03c9773e5468e1f6d2da7d5cbb1875"
+        "1b1ad6250902865aea72bc1e843d45b769e6c553"
     );
 }
 
@@ -421,13 +421,13 @@ fn signature() {
     let signature = cert.signature();
     assert_eq!(
         hex::encode(signature.as_slice()),
-        "4af607b889790b43470442cfa551cdb8b6d0b0340d2958f76b9e3ef6ad4992230cead6842587f0ecad5\
-         78e6e11a221521e940187e3d6652de14e84e82f6671f097cc47932e022add3c0cb54a26bf27fa84c107\
-         4971caa6bee2e42d34a5b066c427f2d452038082b8073993399548088429de034fdd589dcfb0dd33be7\
-         ebdfdf698a28d628a89568881d658151276bde333600969502c4e62e1d3470a683364dfb241f78d310a\
-         89c119297df093eb36b7fd7540224f488806780305d1e79ffc938fe2275441726522ab36d88348e6c51\
-         f13dcc46b5e1cdac23c974fd5ef86aa41e91c9311655090a52333bc79687c748d833595d4c5f987508f\
-         e121997410d37c"
+        "73a2bbd9e91b011f11d18a75e247b09b3288dcc837900ee38ce36f4b8fcef2dbc201db032f5d0206e990f64\
+          e22a5445d559d91dc52797a6a9115cb2325eb79ca4a2c036ac8bb4aae54b2f0c285efc80d404b1c703e\
+          bca56ce85e3a64173853b45d243cb023e8b4fe2ae02ebf59f415938295ce41970a583f147a2f83592cd\
+          0ae639c2da9cd4f04a521b1eada862a2142774aedcc9bb7f4e5019443ba01b50174abc2373566a6e91aa\
+          8ba1e4ddffbec5d308575fa9bd160555965a718dee775568dde57808f0b45794562ab9095fe6242af85f\
+          4c2da698c8b219a3f2054b1c505a526f176ebcee4b16f0ad76b341ba0ddaad7bea1ac97076ed37041fa\
+          45d58b0c"
     );
     let algorithm = cert.signature_algorithm();
     assert_eq!(algorithm.object().nid(), Nid::SHA256WITHRSAENCRYPTION);