grpc 1.68.1 → 1.71.0

data/src/core/lib/security/credentials/external/file_external_account_credentials.cc

@@ -44,7 +44,6 @@ FileExternalAccountCredentials::FileFetchBody::FileFetchBody(
   // Start work asynchronously, since we can't invoke the callback
   // synchronously without causing a deadlock.
   creds->event_engine().Run([self = RefAsSubclass<FileFetchBody>()]() mutable {
-    ApplicationCallbackExecCtx application_exec_ctx;
     ExecCtx exec_ctx;
     self->ReadFile();
     self.reset();

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -82,7 +82,7 @@ grpc_server_credentials* grpc_fake_transport_security_server_credentials_create(
 // For LB channels:
 //     "backend_target_1,backend_target_2,...;lb_target_1,lb_target_2,..."
 // For regular channels:
-//     "backend_taget_1,backend_target_2,..."
+//     "backend_target_1,backend_target_2,..."
 //
 // That is to say, LB channels have a heading list of LB targets separated from
 // the list of backend targets by a semicolon. For non-LB channels, only the

data/src/core/lib/security/credentials/google_default/credentials_generic.cc

@@ -18,11 +18,11 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <optional>
 #include <string>
 
 #include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/google_default/google_default_credentials.h"
 #include "src/core/util/env.h"

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -29,6 +29,7 @@
 #include <string.h>
 
 #include <memory>
+#include <optional>
 #include <string>
 
 #include "absl/log/check.h"
@@ -37,7 +38,6 @@
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/closure.h"
@@ -106,7 +106,7 @@ struct metadata_server_detector {
 
 namespace {
 
-bool IsXdsNonCfeCluster(absl::optional<absl::string_view> xds_cluster) {
+bool IsXdsNonCfeCluster(std::optional<absl::string_view> xds_cluster) {
   if (!xds_cluster.has_value()) return false;
   if (absl::StartsWith(*xds_cluster, "google_cfe_")) return false;
   if (!absl::StartsWith(*xds_cluster, "xdstp:")) return true;
@@ -143,7 +143,7 @@ grpc_google_default_channel_credentials::create_security_connector(
           ? alts_creds_->create_security_connector(call_creds, target, args)
           : ssl_creds_->create_security_connector(call_creds, target, args);
   // grpclb-specific channel args are removed from the channel args set
-  // to ensure backends and fallback adresses will have the same set of channel
+  // to ensure backends and fallback addresses will have the same set of channel
   // args. By doing that, it guarantees the connections to backends will not be
   // torn down and re-connected when switching in and out of fallback mode.
   //

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -50,7 +50,7 @@ grpc_google_iam_credentials::GetRequestMetadata(
 
 grpc_google_iam_credentials::grpc_google_iam_credentials(
     const char* token, const char* authority_selector)
-    : token_(token == nullptr ? absl::optional<grpc_core::Slice>()
+    : token_(token == nullptr ? std::optional<grpc_core::Slice>()
                               : grpc_core::Slice::FromCopiedString(token)),
       authority_selector_(
           grpc_core::Slice::FromCopiedString(authority_selector)),

data/src/core/lib/security/credentials/iam/iam_credentials.h

@@ -23,10 +23,10 @@
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 
+#include <optional>
 #include <string>
 
 #include "absl/status/statusor.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/slice/slice.h"
@@ -58,7 +58,7 @@ class grpc_google_iam_credentials : public grpc_call_credentials {
         static_cast<const grpc_call_credentials*>(this), other);
   }
 
-  const absl::optional<grpc_core::Slice> token_;
+  const std::optional<grpc_core::Slice> token_;
   const grpc_core::Slice authority_selector_;
   const std::string debug_string_;
 };

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -68,7 +68,7 @@ grpc_service_account_jwt_access_credentials::GetRequestMetadata(
     return grpc_core::Immediate(uri.status());
   }
   // See if we can return a cached jwt.
-  absl::optional<grpc_core::Slice> jwt_value;
+  std::optional<grpc_core::Slice> jwt_value;
   {
     gpr_mu_lock(&cache_mu_);
     if (cached_.has_value() && cached_->service_url == *uri &&
@@ -162,7 +162,6 @@ grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(
     gpr_free(clean_json);
   }
   CHECK_EQ(reserved, nullptr);
-  grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx;
   return grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
              grpc_auth_json_key_create_from_string(json_key), token_lifetime)

data/src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -26,13 +26,13 @@
 #include <grpc/support/time.h>
 #include <stdint.h>
 
+#include <optional>
 #include <string>
 
 #include "absl/status/statusor.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
 #include "absl/time/time.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/jwt/json_token.h"
@@ -84,7 +84,7 @@ class grpc_service_account_jwt_access_credentials
     std::string service_url;
     gpr_timespec jwt_expiration;
   };
-  absl::optional<Cache> cached_;
+  std::optional<Cache> cached_;
 
   grpc_auth_json_key key_;
   gpr_timespec jwt_lifetime_;

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -325,7 +325,7 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
     return GRPC_JWT_VERIFIER_TIME_CONSTRAINT_FAILURE;
   }
 
-  // This should be probably up to the upper layer to decide but let's harcode
+  // This should be probably up to the upper layer to decide but let's hardcode
   // the 99% use case here for email issuers, where the JWT must be self
   // issued.
   if (grpc_jwt_issuer_email_domain(claims->iss) != nullptr &&
@@ -377,7 +377,6 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
     grpc_jwt_claims* claims, const char* audience, const grpc_slice& signature,
     const char* signed_jwt, size_t signed_jwt_len, void* user_data,
     grpc_jwt_verification_done_cb cb) {
-  grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx;
   verifier_cb_ctx* ctx = new verifier_cb_ctx();
   ctx->verifier = verifier;

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -144,7 +144,7 @@ void grpc_auth_refresh_token_destruct(grpc_auth_refresh_token* refresh_token) {
 
 grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response_body(
-    absl::string_view body, absl::optional<grpc_core::Slice>* token_value,
+    absl::string_view body, std::optional<grpc_core::Slice>* token_value,
     grpc_core::Duration* token_lifetime) {
   auto json = grpc_core::JsonParse(body);
   if (!json.ok()) {
@@ -187,9 +187,9 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response_body(
 grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response(
     const grpc_http_response* response,
-    absl::optional<grpc_core::Slice>* token_value,
+    std::optional<grpc_core::Slice>* token_value,
     grpc_core::Duration* token_lifetime) {
-  *token_value = absl::nullopt;
+  *token_value = std::nullopt;
   if (response == nullptr) {
     LOG(ERROR) << "Received NULL response.";
     return GRPC_CREDENTIALS_ERROR;
@@ -241,7 +241,7 @@ class Oauth2TokenFetcherCredentials::HttpFetchRequest final
       return;
     }
     // Parse oauth2 token.
-    absl::optional<Slice> access_token_value;
+    std::optional<Slice> access_token_value;
     Duration token_lifetime;
     grpc_credentials_status status =
         grpc_oauth2_token_fetcher_credentials_parse_server_response(

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -26,12 +26,12 @@
 #include <grpc/support/time.h>
 
 #include <atomic>
+#include <optional>
 #include <string>
 #include <utility>
 
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/polling_entity.h"
@@ -176,14 +176,14 @@ grpc_refresh_token_credentials_create_from_auth_refresh_token(
 
 grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response_body(
-    absl::string_view body, absl::optional<grpc_core::Slice>* token_value,
+    absl::string_view body, std::optional<grpc_core::Slice>* token_value,
     grpc_core::Duration* token_lifetime);
 
 // Exposed for testing only.
 grpc_credentials_status
 grpc_oauth2_token_fetcher_credentials_parse_server_response(
     const struct grpc_http_response* response,
-    absl::optional<grpc_core::Slice>* token_value,
+    std::optional<grpc_core::Slice>* token_value,
     grpc_core::Duration* token_lifetime);
 
 namespace grpc_core {

data/src/core/lib/security/credentials/plugin/plugin_credentials.cc

@@ -115,7 +115,6 @@ void grpc_plugin_credentials::PendingRequest::RequestMetadataReady(
     void* request, const grpc_metadata* md, size_t num_md,
     grpc_status_code status, const char* error_details) {
   // called from application code
-  grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx(GRPC_EXEC_CTX_FLAG_IS_FINISHED |
                               GRPC_EXEC_CTX_FLAG_THREAD_RESOURCE_LOOP);
   grpc_core::RefCountedPtr<grpc_plugin_credentials::PendingRequest> r(

data/src/core/lib/security/credentials/ssl/ssl_credentials.cc

@@ -24,12 +24,12 @@
 #include <grpc/support/string_util.h>
 #include <string.h>
 
+#include <optional>
 #include <string>
 #include <utility>
 
 #include "absl/log/check.h"
 #include "absl/log/log.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
@@ -86,7 +86,7 @@ grpc_ssl_credentials::create_security_connector(
                   "must have root certs.";
     return nullptr;
   }
-  absl::optional<std::string> overridden_target_name =
+  std::optional<std::string> overridden_target_name =
       args->GetOwnedString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
   auto* ssl_session_cache = args->GetObject<tsi::SslSessionLRUCache>();
   tsi_ssl_session_cache* session_cache =

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -24,8 +24,8 @@
 #include "absl/status/status.h"
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
-    const std::string& cert_name, absl::optional<std::string> pem_root_certs,
-    absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs) {
+    const std::string& cert_name, std::optional<std::string> pem_root_certs,
+    std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs) {
   CHECK(pem_root_certs.has_value() || pem_key_cert_pairs.has_value());
   grpc_core::MutexLock lock(&mu_);
   auto& cert_info = certificate_info_map_[cert_name];
@@ -37,8 +37,7 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
       const auto watcher_it = watchers_.find(watcher_ptr);
       CHECK(watcher_it != watchers_.end());
       CHECK(watcher_it->second.root_cert_name.has_value());
-      absl::optional<grpc_core::PemKeyCertPairList>
-          pem_key_cert_pairs_to_report;
+      std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs_to_report;
       if (pem_key_cert_pairs.has_value() &&
           watcher_it->second.identity_cert_name == cert_name) {
         pem_key_cert_pairs_to_report = pem_key_cert_pairs;
@@ -62,7 +61,7 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
       const auto watcher_it = watchers_.find(watcher_ptr);
       CHECK(watcher_it != watchers_.end());
       CHECK(watcher_it->second.identity_cert_name.has_value());
-      absl::optional<absl::string_view> pem_root_certs_to_report;
+      std::optional<absl::string_view> pem_root_certs_to_report;
       if (pem_root_certs.has_value() &&
           watcher_it->second.root_cert_name == cert_name) {
         // In this case, We've already sent the credential updates at the time
@@ -100,8 +99,8 @@ bool grpc_tls_certificate_distributor::HasKeyCertPairs(
 
 void grpc_tls_certificate_distributor::SetErrorForCert(
     const std::string& cert_name,
-    absl::optional<grpc_error_handle> root_cert_error,
-    absl::optional<grpc_error_handle> identity_cert_error) {
+    std::optional<grpc_error_handle> root_cert_error,
+    std::optional<grpc_error_handle> identity_cert_error) {
   CHECK(root_cert_error.has_value() || identity_cert_error.has_value());
   grpc_core::MutexLock lock(&mu_);
   CertificateInfo& cert_info = certificate_info_map_[cert_name];
@@ -169,8 +168,8 @@ void grpc_tls_certificate_distributor::SetError(grpc_error_handle error) {
 
 void grpc_tls_certificate_distributor::WatchTlsCertificates(
     std::unique_ptr<TlsCertificatesWatcherInterface> watcher,
-    absl::optional<std::string> root_cert_name,
-    absl::optional<std::string> identity_cert_name) {
+    std::optional<std::string> root_cert_name,
+    std::optional<std::string> identity_cert_name) {
   bool start_watching_root_cert = false;
   bool already_watching_identity_for_root_cert = false;
   bool start_watching_identity_cert = false;
@@ -187,8 +186,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     CHECK(watcher_it == watchers_.end());
     watchers_[watcher_ptr] = {std::move(watcher), root_cert_name,
                               identity_cert_name};
-    absl::optional<absl::string_view> updated_root_certs;
-    absl::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
+    std::optional<absl::string_view> updated_root_certs;
+    std::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
     grpc_error_handle root_error;
     grpc_error_handle identity_error;
     if (root_cert_name.has_value()) {
@@ -253,8 +252,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
 
 void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
     TlsCertificatesWatcherInterface* watcher) {
-  absl::optional<std::string> root_cert_name;
-  absl::optional<std::string> identity_cert_name;
+  std::optional<std::string> root_cert_name;
+  std::optional<std::string> identity_cert_name;
   bool stop_watching_root_cert = false;
   bool already_watching_identity_for_root_cert = false;
   bool stop_watching_identity_cert = false;

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -22,13 +22,13 @@
 #include <functional>
 #include <map>
 #include <memory>
+#include <optional>
 #include <set>
 #include <string>
 #include <utility>
 
 #include "absl/base/thread_annotations.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/util/ref_counted.h"
@@ -48,7 +48,7 @@ struct grpc_tls_certificate_distributor
     virtual ~TlsCertificatesWatcherInterface() = default;
 
     // Handles the delivery of the updated root and identity certificates.
-    // An absl::nullopt value indicates no corresponding contents for
+    // An std::nullopt value indicates no corresponding contents for
     // root_certs or key_cert_pairs. Note that we will send updates of the
     // latest contents for both root and identity certificates, even when only
     // one side of it got updated.
@@ -57,8 +57,8 @@ struct grpc_tls_certificate_distributor
     // @param key_cert_pairs the contents of the reloaded identity key-cert
     // pairs.
     virtual void OnCertificatesChanged(
-        absl::optional<absl::string_view> root_certs,
-        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
+        std::optional<absl::string_view> root_certs,
+        std::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
 
     // Handles an error that occurs while attempting to fetch certificate data.
     // Note that if a watcher sees an error, it simply means the Provider is
@@ -84,8 +84,8 @@ struct grpc_tls_certificate_distributor
   // @param pem_root_certs The content of root certificates.
   // @param pem_key_cert_pairs The content of identity key-cert pairs.
   void SetKeyMaterials(
-      const std::string& cert_name, absl::optional<std::string> pem_root_certs,
-      absl::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
+      const std::string& cert_name, std::optional<std::string> pem_root_certs,
+      std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
 
   bool HasRootCerts(const std::string& root_cert_name);
 
@@ -101,8 +101,8 @@ struct grpc_tls_certificate_distributor
   // @param identity_cert_error The error that the caller encounters when
   // reloading identity certs.
   void SetErrorForCert(const std::string& cert_name,
-                       absl::optional<grpc_error_handle> root_cert_error,
-                       absl::optional<grpc_error_handle> identity_cert_error);
+                       std::optional<grpc_error_handle> root_cert_error,
+                       std::optional<grpc_error_handle> identity_cert_error);
 
   // Propagates the error that the caller (e.g. Producer) encounters to all
   // watchers.
@@ -142,14 +142,14 @@ struct grpc_tls_certificate_distributor
   //
   // @param watcher The watcher being registered.
   // @param root_cert_name The name of the root certificates that will be
-  // watched. If set to absl::nullopt, the root certificates won't be watched.
+  // watched. If set to std::nullopt, the root certificates won't be watched.
   // @param identity_cert_name The name of the identity certificates that will
-  // be watched. If set to absl::nullopt, the identity certificates won't be
+  // be watched. If set to std::nullopt, the identity certificates won't be
   // watched.
   void WatchTlsCertificates(
       std::unique_ptr<TlsCertificatesWatcherInterface> watcher,
-      absl::optional<std::string> root_cert_name,
-      absl::optional<std::string> identity_cert_name);
+      std::optional<std::string> root_cert_name,
+      std::optional<std::string> identity_cert_name);
 
   // Cancels a watcher.
   //
@@ -160,8 +160,8 @@ struct grpc_tls_certificate_distributor
   // Contains the information about each watcher.
   struct WatcherInfo {
     std::unique_ptr<TlsCertificatesWatcherInterface> watcher;
-    absl::optional<std::string> root_cert_name;
-    absl::optional<std::string> identity_cert_name;
+    std::optional<std::string> root_cert_name;
+    std::optional<std::string> identity_cert_name;
   };
   // CertificateInfo contains the credential contents and some additional
   // watcher information.

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -50,7 +50,10 @@ absl::Status ValidateRootCertificates(absl::string_view root_certificates) {
   absl::StatusOr<std::vector<X509*>> parsed_roots =
       ParsePemCertificateChain(root_certificates);
   if (!parsed_roots.ok()) {
-    return parsed_roots.status();
+    return absl::Status(
+        parsed_roots.status().code(),
+        absl::StrCat("Failed to parse root certificates as PEM: ",
+                     parsed_roots.status().message()));
   }
   for (X509* x509 : *parsed_roots) {
     X509_free(x509);
@@ -65,7 +68,10 @@ absl::Status ValidatePemKeyCertPair(absl::string_view cert_chain,
   absl::StatusOr<std::vector<X509*>> parsed_certs =
       ParsePemCertificateChain(cert_chain);
   if (!parsed_certs.ok()) {
-    return parsed_certs.status();
+    return absl::Status(
+        parsed_certs.status().code(),
+        absl::StrCat("Failed to parse certificate chain as PEM: ",
+                     parsed_certs.status().message()));
   }
   for (X509* x509 : *parsed_certs) {
     X509_free(x509);
@@ -74,7 +80,9 @@ absl::Status ValidatePemKeyCertPair(absl::string_view cert_chain,
   absl::StatusOr<EVP_PKEY*> parsed_private_key =
       ParsePemPrivateKey(private_key);
   if (!parsed_private_key.ok()) {
-    return parsed_private_key.status();
+    return absl::Status(parsed_private_key.status().code(),
+                        absl::StrCat("Failed to parse private key as PEM: ",
+                                     parsed_private_key.status().message()));
   }
   EVP_PKEY_free(*parsed_private_key);
   return absl::OkStatus();
@@ -91,8 +99,8 @@ StaticDataCertificateProvider::StaticDataCertificateProvider(
                                               bool root_being_watched,
                                               bool identity_being_watched) {
     MutexLock lock(&mu_);
-    absl::optional<std::string> root_certificate;
-    absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    std::optional<std::string> root_certificate;
+    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     StaticDataCertificateProvider::WatcherInfo& info = watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
         !root_certificate_.empty()) {
@@ -208,8 +216,8 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
                                               bool root_being_watched,
                                               bool identity_being_watched) {
     MutexLock lock(&mu_);
-    absl::optional<std::string> root_certificate;
-    absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    std::optional<std::string> root_certificate;
+    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
         watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
@@ -277,8 +285,8 @@ absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
 }
 
 void FileWatcherCertificateProvider::ForceUpdate() {
-  absl::optional<std::string> root_certificate;
-  absl::optional<PemKeyCertPairList> pem_key_cert_pairs;
+  std::optional<std::string> root_certificate;
+  std::optional<PemKeyCertPairList> pem_key_cert_pairs;
   if (!root_cert_path_.empty()) {
     root_certificate = ReadRootCertificatesFromFile(root_cert_path_);
   }
@@ -317,8 +325,8 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     for (const auto& p : watcher_info_) {
       const std::string& cert_name = p.first;
       const WatcherInfo& info = p.second;
-      absl::optional<std::string> root_to_report;
-      absl::optional<PemKeyCertPairList> identity_to_report;
+      std::optional<std::string> root_to_report;
+      std::optional<PemKeyCertPairList> identity_to_report;
       // Set key materials to the distributor if their contents changed.
       if (info.root_being_watched && !root_certificate_.empty() &&
           root_cert_changed) {
@@ -346,7 +354,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
   }
 }
 
-absl::optional<std::string>
+std::optional<std::string>
 FileWatcherCertificateProvider::ReadRootCertificatesFromFile(
     const std::string& root_cert_full_path) {
   // Read the root file.
@@ -355,7 +363,7 @@ FileWatcherCertificateProvider::ReadRootCertificatesFromFile(
   if (!root_slice.ok()) {
     LOG(ERROR) << "Reading file " << root_cert_full_path
                << " failed: " << root_slice.status();
-    return absl::nullopt;
+    return std::nullopt;
   }
   return std::string(root_slice->as_string_view());
 }
@@ -372,7 +380,7 @@ time_t GetModificationTime(const char* filename) {
 
 }  // namespace
 
-absl::optional<PemKeyCertPairList>
+std::optional<PemKeyCertPairList>
 FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
     const std::string& private_key_path,
     const std::string& identity_certificate_path) {
@@ -433,7 +441,7 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
   }
   LOG(ERROR) << "All retry attempts failed. Will try again after the next "
                 "interval.";
-  return absl::nullopt;
+  return std::nullopt;
 }
 
 int64_t FileWatcherCertificateProvider::TestOnlyGetRefreshIntervalSecond()

data/src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.h

@@ -23,13 +23,13 @@
 #include <stdint.h>
 
 #include <map>
+#include <optional>
 #include <string>
 
 #include "absl/base/thread_annotations.h"
 #include "absl/log/check.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h"
 #include "src/core/lib/security/security_connector/ssl_utils.h"
 #include "src/core/util/ref_counted.h"
@@ -166,11 +166,11 @@ class FileWatcherCertificateProvider final
   // Force an update from the file system regardless of the interval.
   void ForceUpdate();
   // Read the root certificates from files and update the distributor.
-  absl::optional<std::string> ReadRootCertificatesFromFile(
+  std::optional<std::string> ReadRootCertificatesFromFile(
       const std::string& root_cert_full_path);
   // Read the private key and the certificate chain from files and update the
   // distributor.
-  absl::optional<PemKeyCertPairList> ReadIdentityKeyCertPairFromFiles(
+  std::optional<PemKeyCertPairList> ReadIdentityKeyCertPairFromFiles(
       const std::string& private_key_path,
       const std::string& identity_certificate_path);
 

data/src/core/lib/security/credentials/tls/grpc_tls_crl_provider.cc

@@ -191,7 +191,6 @@ void DirectoryReloaderCrlProvider::UpdateAndStartTimer() {
   std::weak_ptr<DirectoryReloaderCrlProvider> self = shared_from_this();
   refresh_handle_ =
       event_engine_->RunAfter(refresh_duration_, [self = std::move(self)]() {
-        ApplicationCallbackExecCtx callback_exec_ctx;
         ExecCtx exec_ctx;
         if (std::shared_ptr<DirectoryReloaderCrlProvider> valid_ptr =
                 self.lock()) {

data/src/core/lib/security/credentials/tls/grpc_tls_crl_provider.h

@@ -36,7 +36,6 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/util/directory_reader.h"
 #include "src/core/util/sync.h"
 #include "src/core/util/time.h"
@@ -120,7 +119,7 @@ class DirectoryReloaderCrlProvider
   Mutex mu_;
   absl::flat_hash_map<::std::string, ::std::shared_ptr<Crl>> crls_
       ABSL_GUARDED_BY(mu_);
-  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
+  std::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
       refresh_handle_;
 };
 

data/src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -24,11 +24,11 @@
 #include <grpc/support/port_platform.h>
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 
 #include "absl/log/log.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h"
 #include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
@@ -103,7 +103,7 @@ grpc_core::RefCountedPtr<grpc_channel_security_connector>
 TlsCredentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
     const char* target_name, grpc_core::ChannelArgs* args) {
-  absl::optional<std::string> overridden_target_name =
+  std::optional<std::string> overridden_target_name =
       args->GetOwnedString(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
   auto* ssl_session_cache = args->GetObject<tsi::SslSessionLRUCache>();
   grpc_core::RefCountedPtr<grpc_channel_security_connector> sc =