[boring] Move package:boring to dart-lang/tools (1/4): vendored BoringSSL, bindings and source build by mosuem · Pull Request #2614 · dart-lang/tools

mosuem · 2026-09-29T13:23:18Z

Moves package:boring from mosuem/boring into pkgs/boring. This is the first of four stacked PRs. Each one passes CI on its own:

Vendored BoringSSL, ffigen bindings, and a build hook that compiles BoringSSL (this PR)
[boring] Move package:boring to dart-lang/tools (2/4): FFI helpers from package:webcrypto #2615: FFI helpers derived from package:webcrypto
[boring] Move package:boring to dart-lang/tools (3/4): prebuilt binaries and tree shaking #2616: Prebuilt binaries, tree shaking with a link hook, and a release workflow
[boring] Move package:boring to dart-lang/tools (4/4): use package:prebuilt_code_assets #2617: Build and link hooks moved onto package:prebuilt_code_assets

The top of the stack matches mosuem/boring at 350a6d1, which is main plus #7. The only differences are license headers, repository URLs, the README, and pubspec metadata.

This PR

Review it commit by commit:

Vendor BoringSSL.
- third_party/boringssl is copied at tool/REVISION by tool/bump-boringssl-revision.sh.
- It's marked linguist-generated, so GitHub collapses it.
- The generated job re-runs the script at tool/REVISION and fails on any diff. You don't need to read the 667 files.
Add ffigen bindings.
- Adds the package skeleton, src/wrapper.h, tool/ffigen.dart, and the generated bindings.
- Wires up the repo: labeler, CODEOWNERS, issue template, and a row in the root README.
- The generated job also regenerates the bindings. They include glibc struct layouts, so the job is pinned to ubuntu-24.04.
Add a build hook that compiles BoringSSL.
- hook/build.dart builds src/CMakeLists.txt with CMake and bundles the dynamic library.
- Tests run on Linux, macOS, and Windows.
- A weekly refresh job updates BoringSSL and opens a PR, like the package:timezone job in dart-lang/labs.
- The refresh job uses the Ecosystem Bot app token, so that CI runs on its PRs.

Notes

License. The package is BSD 3-Clause, like the other packages in this repository.
Version. It stays at 0.4.2-wip. The CHANGELOG keeps the full history, and the git history stays in mosuem/boring.
Health checks. The breaking check may warn until [boring] Move package:boring to dart-lang/tools (2/4): FFI helpers from package:webcrypto #2615, because this PR only has part of the published 0.4.1 API.

After the stack

Transfer boring on pub.dev to the tools.dart.dev publisher. Then enable automated publishing with the tag pattern boring-v{{version}}.
Merging [boring] Move package:boring to dart-lang/tools (3/4): prebuilt binaries and tree shaking #2616 changes pkgs/boring/src/, so the package:boring binaries workflow builds the libraries, attaches them to a boring-binaries-<date>-<commit> pre-release, and opens a pull request that pins them in lib/src/hook_helpers/hashes.dart. Until that pull request lands, the hashes point at the mosuem/boring 0.4.1 release, which is built from an older BoringSSL, and the analyze job warns about it.
Merge the pin pull request, then release 0.4.2 as usual (bump the version, merge, push the publish tag). The analyze job blocks a non--wip version whose pinned libraries weren't built from the vendored sources.

github-actions · 2026-09-29T13:24:28Z

Package publishing

If you have publishing permissions, you can use the links below to publish the changes after merging this PR.

Package	Version	Status	Publish tag (post-merge)
package:boring ⭐	0.4.2-wip	WIP (no publish necessary)
package:test_reflective_loader	0.6.0	ready to publish	`test_reflective_loader-v0.6.0`

19 already published.
22 WIP (no publish necessary).

Documentation at https://github.com/dart-lang/ecosystem/wiki/Publishing-automation.

github-actions · 2026-09-29T13:25:37Z

PR Health

Coverage

⚠️

File	Coverage
pkgs/boring/example/boring_example.dart	💔 Not covered
pkgs/boring/hook/build.dart	💔 Not covered
pkgs/boring/lib/bindings.dart	💔 Not covered
pkgs/boring/lib/boring.dart	💔 Not covered
pkgs/boring/tool/ffigen.dart	💔 Not covered

This check for test coverage is informational (issues shown here will not fail the PR).

This check can be disabled by tagging the PR with skip-coverage-check.

License Headers ✔️

// Copyright (c) 2026, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.

Files
no missing headers

All source files should start with a license header.

Unrelated files missing license headers

Files
pkgs/html/test/differential_test.dart
pkgs/html/test/dom_parsing_test.dart
pkgs/html/test/mxss_test.dart
pkgs/html/test/noah_ark_clause_limit_test.dart

This check can be disabled by tagging the PR with skip-license-check.

Breaking changes ✔️

Package	Change	Current Version	New Version	Needed Version	Looking good?
boring	Breaking	0.4.1	0.4.2-wip	0.4.2-wip	✔️

This check can be disabled by tagging the PR with skip-breaking-check.

Unused Dependencies ✔️

Package	Status
boring	✔️ All dependencies utilized correctly.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

API leaks

⚠️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package	Leaked API symbol	Leaking sources
boring	self._SymbolAddresses	bindings/boringssl.g.dart::SymbolAddresses bindings/boringssl.g.dart::addresses
boring	self.__va_list_tag	bindings/boringssl.g.dart::BIO_vsnprintf::args bindings/boringssl.g.dart::OPENSSL_vasprintf::args
boring	self.__locale_struct	bindings/boringssl.g.dart::locale_t

This check can be disabled by tagging the PR with skip-leaking-check.

Changelog Entry ✔️

Package	Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.

gemini-code-assist

Code Review

This pull request adds the boring package to the repository, providing raw FFI bindings to BoringSSL compiled and bundled via Dart Native Assets. The implementation includes CMake build configurations, FFI wrappers, and test suites to validate symbol isolation and binding correctness. While the overall structure is solid, several critical issues must be addressed: compilation errors in the tests due to the undefined providesSymbol method on DynamicLibrary and the non-existent isNonZero matcher, a potential CMake list-to-string issue with MSVC warning flags, a missing '.s' extension in the build dependency tracker, and a type safety warning regarding address.cast().

natebosch · 2026-09-29T16:24:31Z

I have this on the agenda for the ecosystem team meeting. I expect there will be consensus on transferring this so it should be quick to discuss.

Add the BoringSSL sources that package:boring builds, pinned to the revision in tool/REVISION, and tool/bump-boringssl-revision.sh, which re-vendors them from boringssl.googlesource.com. The `generated` job in .github/workflows/boring.yaml re-runs the script at the pinned revision and fails on any diff, so third_party/boringssl doesn't need to be reviewed by hand. .gitattributes collapses it in diffs.

Add the package skeleton and the raw bindings generated from src/wrapper.h by tool/ffigen.dart: - pubspec.yaml, CHANGELOG.md (the published history plus the move), README.md, LICENSE, analysis_options.yaml. - lib/boring.dart and lib/bindings.dart, which export the bindings. - lib/src/bindings/*.g.dart, marked linguist-generated. - The ffigen step in tool/bump-boringssl-revision.sh, so the `generated` job now also checks that the bindings match the vendored headers. It runs on ubuntu-24.04 because the output includes glibc struct layouts. - An `analyze` job, and the usual repo wiring (labeler, CODEOWNERS, issue template, root README). The @Native bindings resolve once the build hook in the next commit provides the code asset.

hook/build.dart compiles the vendored BoringSSL with CMake (src/CMakeLists.txt) and bundles the dynamic library as the package:boring/boring.dart code asset, which the bindings resolve against. - test/boring_test.dart calls a few functions through the bindings, and test/symbols_test.dart checks that the library defines every bound function. The `test` job runs them on Linux, macOS and Windows. - A weekly `refresh` job runs tool/bump-boringssl-revision.sh at BoringSSL's HEAD and, if anything changed, opens a PR with the Dart Bot token, like the one for package:timezone in dart-lang/labs. Prebuilt binaries and tree shaking with a link hook come later in the stack.

Revisions updated by `dart tools/rev_sdk_deps.dart`. dartdoc (https://github.com/dart-lang/dartdoc/compare/5eb0f2c..e1859cf): e1859cfc Fri Oct 9 14:53:01 2026 +0200 Sarah Zakarias Link a bare prefix only when it maps to exactly one library (dart-lang/dartdoc#4295) c48f6fb9 Fri Oct 9 14:25:42 2026 +0200 Sarah Zakarias Resolve prefixes through the analyzer's PrefixElement.scopeLibraries (dart-lang/dartdoc#4294) 3a6297e2 Wed Oct 7 12:56:14 2026 +0200 Sarah Zakarias Require analyzer 14.5.0 and bump to 9.0.10 (dart-lang/dartdoc#4292) ecosystem (https://github.com/dart-lang/ecosystem/compare/16dca7a..622ef61): 622ef61 Mon Oct 12 00:23:27 2026 -0700 Kevin Moore fix(firehose): enforce -wip on published versions and tighten changelog checks (dart-lang/ecosystem#467) 5576a85 Wed Oct 7 09:29:44 2026 +0200 Moritz Support use-flutter option in groundskeeper workflow (dart-lang/ecosystem#444) http (https://github.com/dart-lang/http/compare/585d433..23f8574): 23f8574 Thu Oct 8 23:27:25 2026 +0700 Cong Bang feat(http2): configurable receive windows and frame size (dart-lang/http#1999) 18051a6 Thu Oct 8 10:39:38 2026 +0200 Moritz Enable Flutter in Groundskeeper workflow for Flutter packages (dart-lang/http#2004) native (https://github.com/dart-lang/native/compare/a2a6179..10515af): 10515afca Mon Oct 12 12:21:52 2026 +0200 Daco Harkes [native_toolchain_c] Do not pass linker flags when compiling static libraries (dart-lang/native#3731) native is held back at 10515af, before dart-lang/native#3728, because it breaks the dartdev `dart install` native assets tests. See dart-lang/native#3743. test (https://github.com/dart-lang/test/compare/d749b10..30acb69): 30acb69e Mon Oct 12 12:42:54 2026 -0700 Nate Bosch Time out browser loads just before the suite load timeout (dart-lang/test#2786) 597a0326 Mon Oct 12 12:22:53 2026 -0700 Kevin Moore Fix misplaced changelog entries and remove no-op health check (dart-lang/test#2789) 0b6efee8 Mon Oct 12 12:16:29 2026 -0700 Nate Bosch [checks] Collapse nested subjects in condition descriptions (dart-lang/test#2784) 17c98493 Mon Oct 12 12:08:23 2026 -0700 Nate Bosch Follow symlinks in precompiled browser test directories (dart-lang/test#2787) 1cc813ec Fri Oct 9 11:59:56 2026 -0700 Nate Bosch [checks] Join nested collapsed subjects with "that" (dart-lang/test#2783) ada7b950 Thu Oct 8 12:03:42 2026 -0700 Nate Bosch Prepare to publish (dart-lang/test#2780) c4b165b3 Wed Oct 7 11:29:08 2026 -0700 Kevin Moore [checks] Require package:meta ^1.17.0 (dart-lang/test#2779) 4a363d70 Tue Oct 6 10:46:31 2026 -0700 Nate Bosch Let Chrome choose its remote debugging port (dart-lang/test#2778) 465d66ab Tue Oct 6 09:35:22 2026 -0700 Nate Bosch Keep Chrome stderr in the browser output when debugging (dart-lang/test#2777) tools (https://github.com/dart-lang/tools/compare/a66d517..2b54c71): 2b54c71af Mon Oct 12 10:16:45 2026 +0200 dart-ecosystem-bot[bot] [boring] Update BoringSSL to 3fed4f20 (dart-lang/tools#2655) 2337f995a Sat Oct 10 03:11:40 2026 +0300 Hasan Armoush [json_rpc_2] Add strictProtocolChecks parameter to Client (dart-lang/tools#2555) c65c69ed1 Fri Oct 9 08:54:25 2026 +0200 Moritz [boring] Move package:boring to dart-lang/tools (2/4): FFI helpers from package:webcrypto (dart-lang/tools#2615) a04e45491 Thu Oct 8 21:07:18 2026 -0700 Kevin Moore chore: wire package:api_summary and package:string_scanner PR auto-labeler (dart-lang/tools#2652) 8bdd4b92c Thu Oct 8 09:20:48 2026 +0200 Morgan :) [code_builder] Allow built_collection 6.x. (dart-lang/tools#2645) c16040d35 Wed Oct 7 17:30:08 2026 -0700 Kevin Moore [api_summary] Sort primary barrel first and experimental entry points last (v1.2.0) (dart-lang/tools#2619) b2d0780db Wed Oct 7 11:27:16 2026 -0700 Kevin Moore [stream_channel] Require package:async ^2.6.0 (dart-lang/tools#2644) 3ab7bf9d0 Wed Oct 7 11:35:27 2026 +0200 Moritz [boring] Move package:boring to dart-lang/tools (1/4): vendored BoringSSL, bindings and source build (dart-lang/tools#2614) 29df6348b Tue Oct 6 15:21:44 2026 -0700 Kevin Moore feat(coverage): support web coverage reports in test_with_coverage (dart-lang/tools#2448) Regenerate pkg/{analyzer,analyzer_plugin,analyzer_testing}/api.txt. The rolled package:api_summary v1.2.0 (dart-lang/tools#2619) sorts the primary barrel first and other entry points after it, so entries in these files are reordered. The APIs themselves are unchanged. Change-Id: Ie8ff19c5a981ea8ecee8939c75457986a947e0a7 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/563220 Reviewed-by: Samuel Rawlins <[email protected]> Auto-Submit: Nate Bosch <[email protected]> Reviewed-by: Paul Berry <[email protected]> Commit-Queue: Paul Berry <[email protected]>

mosuem added this pull request to stack #2618 September 29, 2026 13:23

github-actions Bot added the type-infra A repository infrastructure change or enhancement label Sep 29, 2026

mosuem changed the title ~~boring/1 bindings build hook~~ [boring] Move package:boring to dart-lang/tools (1/4): vendored BoringSSL, bindings and source build Sep 29, 2026

gemini-code-assist Bot reviewed Sep 29, 2026

View reviewed changes

Comment thread pkgs/boring/test/symbols_test.dart Resolved

Comment thread pkgs/boring/test/boring_test.dart Resolved

Comment thread pkgs/boring/src/CMakeLists.txt Resolved

Comment thread pkgs/boring/hook/build.dart Resolved

Comment thread pkgs/boring/test/symbols_test.dart Resolved

mosuem force-pushed the boring/1-bindings-build-hook branch from 76d50a1 to 66c4fdc Compare September 29, 2026 14:01

mosuem marked this pull request as ready for review September 29, 2026 16:22

mosuem requested a review from a team as a code owner September 29, 2026 16:22

brianquinlan reviewed Sep 29, 2026

View reviewed changes

mosuem force-pushed the boring/1-bindings-build-hook branch 4 times, most recently from f36df01 to cd4d093 Compare September 30, 2026 12:49

mosuem force-pushed the boring/1-bindings-build-hook branch from cd4d093 to 20a3ee4 Compare September 30, 2026 14:14

mosuem added 2 commits September 30, 2026 14:18

mosuem force-pushed the boring/1-bindings-build-hook branch from 20a3ee4 to 31b1102 Compare September 30, 2026 14:18

mosuem requested a review from brianquinlan September 30, 2026 14:24

brianquinlan approved these changes Oct 6, 2026

View reviewed changes

mosuem merged commit 3ab7bf9 into main Oct 7, 2026
25 checks passed

mosuem deleted the boring/1-bindings-build-hook branch October 7, 2026 09:35

Navigation Menu

Repository navigation

[boring] Move package:boring to dart-lang/tools (1/4): vendored BoringSSL, bindings and source build - #2614

[boring] Move package:boring to dart-lang/tools (1/4): vendored BoringSSL, bindings and source build#2614
mosuem merged 3 commits into
mainfrom
boring/1-bindings-build-hook

mosuem commented Sep 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natebosch commented Sep 29, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mosuem commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This PR

Notes

After the stack

Uh oh!

github-actions Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package publishing

Uh oh!

github-actions Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Health

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natebosch commented Sep 29, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mosuem commented Sep 29, 2026 •

edited

Loading

github-actions Bot commented Sep 29, 2026 •

edited

Loading

github-actions Bot commented Sep 29, 2026 •

edited

Loading