)]}'
{
  "commit": "433a8f552f007255d3a0fa13aa7963e0281c9981",
  "tree": "8ef1e61cf66cdfe3a76991651f7ed80aead928ef",
  "parents": [
    "6ba010eaada9c089c92804969f9181d88d7ccc7c"
  ],
  "author": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Wed Jul 08 23:27:05 2026 +0100"
  },
  "committer": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Thu Jul 09 12:09:55 2026 +0100"
  },
  "message": "[tls] Retain a reference in the key schedule to the bound identity\n\nChange the \"bound\" field from being a boolean flag to being a\nreference to the server identity (i.e. the certificate) to which the\nshared secret has been bound.\n\nThis reduces the chances for future bugs that could be caused by\npotentially losing track of which identity has been bound, and also\nprovides a natural way to extend the field to be able to represent an\nidentity that has not yet been validated (as will be required for TLS\nversion 1.3 key exchange).\n\nAdd a check that the bound identity has been validated at the point of\nsending our client Finished handshake.  We must defer sending the\nclient Finished until validation has completed, to prevent the server\nfrom sending application traffic until we are ready to receive it, and\nso this provides a natural point at which we know that the bound\nidentity must have been validated.\n\nSince the validity check is now deferred until the point of sending\nthe client Finished, and since commit 6ba010e (\"[tls] Reject incorrect\nserver names before completing validation\") already ensures that the\ncertificate must have the correct name, there is no need to extract\nand store the certificate\u0027s public key separately after validation has\ncompleted.\n\nWe also update the session key (and related parameters) only if the\nbound identity has been validated.  This creates an invariant that if\na server certificate is stored in the session then it is always\nguaranteed to be valid, which simplifies reasoning about session\nresumption flows.\n\nSigned-off-by: Michael Brown \u003cmcb30@ipxe.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cbaae22155c42dc4ff92e1cf7e62867338c81ffb",
      "old_mode": 33188,
      "old_path": "src/include/ipxe/tls.h",
      "new_id": "d9da163930382fcd0b9f15e1cdd0172557b45ae9",
      "new_mode": 33188,
      "new_path": "src/include/ipxe/tls.h"
    },
    {
      "type": "modify",
      "old_id": "41111b522ba05a01e52267fe07930d9e7cea76e6",
      "old_mode": 33188,
      "old_path": "src/net/tls.c",
      "new_id": "b06d5b64836e62ef2d0270b9a6eb17174107f7b6",
      "new_mode": 33188,
      "new_path": "src/net/tls.c"
    }
  ]
}