)]}'
{
  "commit": "9d1e120c421440b450e87cc6ac8900658f9bf01a",
  "tree": "51eef71cfe53ec7fc4233c025b0dd699f75db472",
  "parents": [
    "5c13cab36b4667cc1a42667b16b8f049016586e0"
  ],
  "author": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Thu Apr 30 20:20:56 2020 -0400"
  },
  "committer": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Fri May 08 00:05:04 2020 +0000"
  },
  "message": "crypto/x509: require perfect matches for invalid hostnames\n\nWhen the input or SAN dNSNames are not valid hostnames, the specs don\u0027t\ndefine what should happen, because this should ideally never happen, so\neverything we do is undefined behavior. Browsers get to just return an\nerror, because browsers can assume that the resolving layer is DNS. We\ncan\u0027t, names can be resolved by anything implementing a Dial function,\nand the crypto/x509 APIs can also be used directly without actual\nnetworks in sight.\n\nTrying to process invalid hostnames leads to issues like #27591 where\nwildcards glob stuff they aren\u0027t expected to, because wildcards are only\ndefined on hostnames.\n\nTry to rationalize the behavior like this: if both the VerifyHostname\ninput and the SAN dNSNames are a valid hostname, follow the specs;\notherwise, only accept perfect 1:1 case-insensitive matches (without\nwildcards or trailing dot processing).\n\nThis should allow us to keep supporting weird names, with less\nunexpected side-effects from undefined behavior. Also, it\u0027s a rule, even\nif completely made up, so something we can reason about and code against.\n\nThe commonName field does allow any string, but no specs define how to\nprocess it. Processing it differently from dNSNames would be confusing,\nand allowing it to match invalid hostnames is incompatible with Name\nConstraint processing (#24151).\n\nThis does encourage invalid dNSNames, regrettably, but we need some way\nfor the standard API to match weird names, and the alternative of\nkeeping CN alive sounds less appealing.\n\nFixes #27591\n\nChange-Id: Id2d515f068a17ff796a32b30733abe44ad4f0339\nReviewed-on: https://go-review.googlesource.com/c/go/+/231378\nRun-TryBot: Filippo Valsorda \u003cfilippo@golang.org\u003e\nTryBot-Result: Gobot Gobot \u003cgobot@golang.org\u003e\nReviewed-by: Katie Hockman \u003ckatie@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "05936f2e358db061096460719a04c1a437459056",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/verify.go",
      "new_id": "7427c5714f7aa12d288736115cb4b30cdcf52a97",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/verify.go"
    },
    {
      "type": "modify",
      "old_id": "05bade5a8f31ad55ca7073f4b9fe125a2776743a",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/x509_test.go",
      "new_id": "7e431a6e9ee0d656b952e7b5598927c8efaa2dee",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/x509_test.go"
    }
  ]
}