Repository navigation
fix: remove deprecated OpenSSL APIs from bundled ncrypto - #1082
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🤖 End-to-End Test Results - AndroidStatus: ✅ Passed 📸 Final Test ScreenshotScreenshot automatically captured from End-to-End tests and will expire in 30 days This comment is automatically updated on each test run. |
Contributor
🤖 End-to-End Test Results - iOSStatus: ✅ Passed 📸 Final Test ScreenshotScreenshot automatically captured from End-to-End tests and will expire in 30 days This comment is automatically updated on each test run. |
Track a reduced ncrypto snapshot and use provider encoders for traditional key exports. Preserve prime-check assurance and fix private DER import routing exposed by regression coverage. Fixes #1081
Keep the reviewed compatibility changes in boorad/ncrypto and pin its published revision. Initialize ncrypto in C++ CI and stop the iOS cache from overwriting checked-out dependency sources.
Keep the fork main identical to upstream and carry RNQC compatibility on a separate single-commit branch. Cover explicit EC parameter export and record linear-history and fork maintenance rules.
Keep the local runner introduced in #1083, verify default-branch trust inputs before signing or uploads, and finish all commits before final-head qualification. Refresh the CocoaPods checksum for the updated source list.
boorad
force-pushed
the
fix/1081-ncrypto-openssl-deprecations
branch
from
October 26, 2026 16:43
16e8283 to
ce0f69c
Compare
Collaborator
Author
|
Local validation: pass
This summary is display only; the signed blocks below decide. |
boorad
marked this pull request as draft
October 26, 2026 17:11
Replace the reduced fork with a focused default-off profile, retain all upstream APIs and infrastructure, and enable the profile consistently in RNQC native builds and the compiler gate.
Collaborator
Author
|
Source: Worker-reported; the verifier checks the signature and source bindings, not whether commands ran. Coverage: 2/2 checks reported; 7 omissions. Coverage omissions (7)
Source and environment
Command results
Signed machine-readable evidenceThe exact signed bytes are preserved below for verification and audit tooling. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolve #1081 without reducing or vendoring ncrypto. Keep the Git submodule, advance it to upstream
c954a1aplus one focused compatibility commit, and pinef5d829e27c9fcf539d4bf6b478353b888d607a2from boorad/ncrypto #4.Dependency scope
The fork patch is 8 files, +283/-39, zero deleted files. All upstream APIs, tests, build systems, CI, and tooling remain. Most OpenSSL provider migration already exists upstream.
The patch adds default-off
NCRYPTO_EVP_ONLYfor OpenSSL 3.6+: it excludes ENGINE compatibility only when enabled and propagates the definition to CMake/pkg-config consumers. It also checks the X509 BIO rewind, fixes traditional EC PEM export with empty passwords, preserves explicit EC parameters during SPKI export, and honors requested prime-check assurance. The default backend/API contract remains intact.Fork
mainstays identical to upstream. The compatibility branch contains exactly one commit and stays separate from mirroredmain.RNQC changes
Validation
43328ed: default OpenSSL 34/34, EVP-only OpenSSL 34/34, pinned BoringSSL 25/25 tests pass. Finalef5d829adds one checked BIO rewind, independently reviewed; strict source/header gate passes.642518e529538a9dc1d4685205243fcdd5597619.642518e529538a9dc1d4685205243fcdd5597619: 41 suites, 2,208 tests, zero failures on each platform. Posted exact-head attestation, envelopecf835d2745ea4037b057d6e97e0fba58f5015e8b2fd6610fd63d9b73bc5a826f; local signature/context verification passes.Delivery
Library changes ship through the next npm release and native app rebuilds. Agent instructions take effect in the repository. The default-branch attestation verifier validates worker-asserted local evidence; GitHub does not run the mobile suites. Deprecated calls elsewhere in RNQC remain outside this issue.
Fixes #1081