upgrade-boringssl

Bun pins BoringSSL by commit SHA in scripts/build/deps/boringssl.ts (BORINGSSL_COMMIT). The build downloads a tarball from oven-sh/boringssl at that SHA — there is no submodule and vendor/boringssl/ is git-ignored.

The fork carries a small patch set on top of upstream (see "Preserved patches" below). Upgrading means: merge google/boringssl into oven-sh/boringssl@master, push, then bump the SHA + regenerate source lists in Bun.

Steps

1. Clone the fork and merge upstream

git clone https://github.com/oven-sh/boringssl.git /tmp/boringssl
cd /tmp/boringssl
git remote add upstream https://github.com/google/boringssl.git
git fetch upstream
git log --oneline $(git merge-base HEAD upstream/main)..HEAD   # our patches
git merge upstream/main

Resolve conflicts preserving the fork's additions. Most conflicts are upstream's periodic |...| → `...` doc-comment restyle landing adjacent to a line we added — keep our line + upstream's comment style. For include/openssl/nid.h, keep upstream's new NIDs and ours (our NID numbers are from OpenSSL's range and don't collide with BoringSSL's sequential allocation).

2. Verify the merged tree builds

cmake -B build -GNinja -DCMAKE_BUILD_TYPE=Release
ninja -C build crypto ssl decrepit

This catches mis-resolved conflicts before they reach Bun's CI.

3. Push to the fork

The default branch is master (not main).

git push origin HEAD:master
NEW_SHA=$(git rev-parse HEAD)

4. Bump Bun

In the bun repo:

• scripts/build/deps/boringssl.ts — set BORINGSSL_COMMIT to $NEW_SHA.

• test/js/node/process/process.test.js — update the boringssl: entry in expectedVersions to $NEW_SHA.

• Regenerate the source lists (the file's header comment has the exact one-liner). Only gen/sources.json is authoritative — diff old vs new and apply the delta:

  rm -rf vendor/boringssl   # force re-fetch on next build
  bun bd --target=clone-boringssl
  bun -e 'const j=require("./vendor/boringssl/gen/sources.json");
          const f=l=>l.map(JSON.stringify).join(", ");
          for(const k of ["bcm","crypto","ssl","decrepit"]) console.log(k,"\n",f(j[k].srcs));
          console.log("asm\n",f([...j.bcm.asm,...j.crypto.asm]));
          console.log("nasm\n",f([...j.bcm.nasm,...j.crypto.nasm]))'