)]}'
{
  "commit": "5c2b5ee3c8271c3d19d8f0c38804983950c752bf",
  "tree": "336838b33e521ba8262cd071738633d9fcce8b9f",
  "parents": [
    "efdb1813a0f65b04fdfe9982b68f4f6d31eda277"
  ],
  "author": {
    "name": "Brad Fitzpatrick",
    "email": "bradfitz@golang.org",
    "time": "Thu Dec 15 05:53:01 2016 +0000"
  },
  "committer": {
    "name": "Brad Fitzpatrick",
    "email": "bradfitz@golang.org",
    "time": "Wed Jan 25 17:21:33 2017 +0000"
  },
  "message": "[release-branch.go1.7] crypto/x509: speed up and deflake non-cgo Darwin root cert discovery\n\nBackporting Go 1.8\u0027s fix to #18203\nFixes #18688\n\n---\n\nPiping into security verify-cert only worked on macOS Sierra, and was\nflaky for unknown reasons. Users reported that the number of trusted\nroot certs stopped randomly jumping around once they switched to using\nverify-cert against files on disk instead of /dev/stdin.\n\nBut even using \"security verify-cert\" on 150-200 certs took too\nlong. It took 3.5 seconds on my machine. More than 4 goroutines\nhitting verify-cert didn\u0027t help much, and soon started to hurt\ninstead.\n\nNew strategy, from comments in the code:\n\n// 1. Run \"security trust-settings-export\" and \"security\n//    trust-settings-export -d\" to discover the set of certs with some\n//    user-tweaked trusy policy. We\u0027re too lazy to parse the XML (at\n//    least at this stage of Go 1.8) to understand what the trust\n//    policy actually is. We just learn that there is _some_ policy.\n//\n// 2. Run \"security find-certificate\" to dump the list of system root\n//    CAs in PEM format.\n//\n// 3. For each dumped cert, conditionally verify it with \"security\n//    verify-cert\" if that cert was in the set discovered in Step 1.\n//    Without the Step 1 optimization, running \"security verify-cert\"\n//    150-200 times takes 3.5 seconds. With the optimization, the\n//    whole process takes about 180 milliseconds with 1 untrusted root\n//    CA. (Compared to 110ms in the cgo path)\n\nChange-Id: I79737d9f2cb9b020ba297a326d4d31d68c7e9fee\nReviewed-on: https://go-review.googlesource.com/35634\nReviewed-by: Joe Tsai \u003cthebrokentoaster@gmail.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "59b303d64f74efc92137858ee39252d6e7e25e31",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/root_darwin.go",
      "new_id": "acdf43c94a9c36880a56639c809fc3437e15caea",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/root_darwin.go"
    },
    {
      "type": "modify",
      "old_id": "c8ca3ead70034aa89cc6ba7c23351694a9cbab81",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/root_darwin_test.go",
      "new_id": "ac97e4e6bb8e3ca6b56e766e459c13fed0808a6d",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/root_darwin_test.go"
    }
  ]
}