use boringssl's upstream directly; removes need for our fork and committed generated files #945
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When we added boringssl the only way to integrate it without requiring golang was to commit generated files in to the repository. This is quite the horror to me because it makes it difficult for anyone (including ourselves) to check that the generated files haven't been tampered with by whoever committed them. To try and mitigate that, the repo we store the generated files in (https://github.com/AntelopeIO/boringssl-build) contains a workflow to double check the committed files by generating them itself using golang etc. Still very undesirable though.
A handful of months ago boringssl modified their build structure so that golang was no longer required to use the cmake files. And, astonishingly, it Just Works even in our use case.
This is a big deal. It makes it trivial for anyone (including ourselves) to verify that we're using upstream verbatim. I think it's worth doing the upgrade.
I eyeballed the commit titles (and it some cases the commit contents) from our prior pinned commit of a1843d6. Didn't see anything alarming (anything that could affect our usage). Certainly could be worth another set of eyeballs skimming over the commit title history (https://boringssl.googlesource.com/boringssl/+log).
Didn't see any differences in our benchmark application (the merkle test is a bit persnickety for me to get consistent results though unless I increase the number of runs substantially, since these otherwise run very few runs)