visaljs 0.0.1 → 0.0.3

package/runtime/third_party/boringssl/include/openssl/cmac.h

@@ -0,0 +1,91 @@
+// Copyright 2015 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CMAC_H
+#define OPENSSL_HEADER_CMAC_H
+
+#include <openssl/base.h>   // IWYU pragma: export
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// CMAC.
+//
+// CMAC is a MAC based on AES-CBC and defined in
+// https://tools.ietf.org/html/rfc4493#section-2.3.
+
+
+// One-shot functions.
+
+// AES_CMAC calculates the 16-byte, CMAC authenticator of `in_len` bytes of
+// `in` and writes it to `out`. The `key_len` may be 16 or 32 bytes to select
+// between AES-128 and AES-256. It returns one on success or zero on error.
+OPENSSL_EXPORT int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
+                            const uint8_t *in, size_t in_len);
+
+
+// Incremental interface.
+
+// CMAC_CTX_new allocates a fresh `CMAC_CTX` and returns it, or NULL on
+// error.
+OPENSSL_EXPORT CMAC_CTX *CMAC_CTX_new(void);
+
+// CMAC_CTX_free frees a `CMAC_CTX`.
+OPENSSL_EXPORT void CMAC_CTX_free(CMAC_CTX *ctx);
+
+// CMAC_CTX_copy sets `out` to be a duplicate of the current state `in`. It
+// returns one on success and zero on error.
+OPENSSL_EXPORT int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in);
+
+// CMAC_Init configures `ctx` to use the given `key` and `cipher`. The CMAC RFC
+// only specifies the use of AES-128 thus `key_len` should be 16 and `cipher`
+// should be `EVP_aes_128_cbc()`. However, this implementation also supports
+// AES-256 by setting `key_len` to 32 and `cipher` to `EVP_aes_256_cbc()`. The
+// `engine` argument is ignored.
+//
+// It returns one on success or zero on error.
+OPENSSL_EXPORT int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
+                             const EVP_CIPHER *cipher, ENGINE *engine);
+
+
+// CMAC_Reset resets `ctx` so that a fresh message can be authenticated.
+OPENSSL_EXPORT int CMAC_Reset(CMAC_CTX *ctx);
+
+// CMAC_Update processes `in_len` bytes of message from `in`. It returns one on
+// success or zero on error.
+OPENSSL_EXPORT int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len);
+
+// CMAC_Final sets `*out_len` to 16 and, if `out` is not NULL, writes 16 bytes
+// of authenticator to it. It returns one on success or zero on error.
+OPENSSL_EXPORT int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len);
+
+
+#if defined(__cplusplus)
+}  // extern C
+
+extern "C++" {
+
+BSSL_NAMESPACE_BEGIN
+
+BORINGSSL_MAKE_DELETER(CMAC_CTX, CMAC_CTX_free)
+
+BSSL_NAMESPACE_END
+
+}  // extern C++
+
+#endif
+
+#endif  // OPENSSL_HEADER_CMAC_H

package/runtime/third_party/boringssl/include/openssl/cms.h

@@ -0,0 +1,147 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CMS_H
+#define OPENSSL_HEADER_CMS_H
+
+#include <openssl/base.h>   // IWYU pragma: export
+
+#include <openssl/stack.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// CMS.
+//
+// This library contains functions for implementing a small subset of OpenSSL's
+// API for CMS (RFC 5652). A general CMS implementation, notably one suitable
+// for S/MIME, is out of scope for BoringSSL.
+//
+// As this library is intentionally not a general CMS implementation, BoringSSL
+// continues to define `OPENSSL_NO_CMS`, so that most callers turn off their
+// general-purpose CMS code. In callers that are compatible with this subset,
+// the `BORINGSSL_NO_NO_CMS` build option can be used to suppress
+// `OPENSSL_NO_CMS`.
+
+
+DECLARE_STACK_OF(X509)
+
+// CMS_* are flags that can be passed to functions in this library. Their
+// interpretation is specified in the corresponding functions.
+#define CMS_NOCERTS 0x2
+#define CMS_DETACHED 0x40
+#define CMS_BINARY 0x80
+#define CMS_NOATTR 0x100
+#define CMS_NOSMIMECAP 0x200
+#define CMS_STREAM 0x1000
+#define CMS_PARTIAL 0x4000
+#define CMS_USE_KEYID 0x10000
+#define CMS_NO_SIGNING_TIME 0x400000
+
+// CMS_sign returns a newly-allocated `CMS_ContentInfo` structure for building a
+// SignedData (RFC 5652), or NULL on error.
+//
+// `certs` must be NULL or zero length. BoringSSL does not support embedding
+// certificates in SignedData.
+//
+// `flags` must contain `CMS_DETACHED`, which indicates an external signature.
+// BoringSSL only supports generating external signatures and does not support
+// embedding encapsulated content directly in a SignedData.
+//
+// If `pkey` is non-NULL, `CMS_add1_signer` is automatically called with
+// `signcert`, `pkey`, a default hash of SHA-256, and `flags`. `flags` will then
+// additionally be interpreted as in `CMS_add1_signer`.
+//
+// If `CMS_PARTIAL` or `CMS_STREAM` is set in `flags`, the object will be left
+// incomplete. `data` will then be ignored and should be NULL. The caller can
+// then continue configuring it and finalizing it with `CMS_final`. Otherwise,
+// the object will be finalized with `data` and `flags` passed to `CMS_final`.
+OPENSSL_EXPORT CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey,
+                                         STACK_OF(X509) *certs, BIO *data,
+                                         uint32_t flags);
+
+// CMS_ContentInfo_free releases memory associated with `cms`.
+OPENSSL_EXPORT void CMS_ContentInfo_free(CMS_ContentInfo *cms);
+
+// CMS_add1_signer adds a signer to `cms`, which must be a SignedData created by
+// `CMS_sign`, with the `CMS_PARTIAL` flag set. The signer will use `signcert`,
+// `pkey`, and `md` for the signing certificate, private key, and digest
+// algorithm, respectively. It returns a non-NULL pointer to the signer on
+// success, and NULL on error. The signer is owned by `cms` and should not be
+// released by the caller.
+//
+// `flags` is interpreted as follows:
+//
+// - `CMS_PARTIAL` must not be set. BoringSSL does not support configuring a
+//   signer in multiple steps.
+//
+// - `CMS_NOCERTS` must be set. BoringSSL does not support embedding
+//   certificates in SignedData.
+//
+// - `CMS_NOATTR` must be set. BoringSSL does not support attributes in
+//   SignedData.
+//
+// - If `CMS_USE_KEYID` is set, SignerInfos will be identified by subject key
+//   identifier instead of issuer and serial number. `signcert` must then have
+//   the subject key identifier extension.
+//
+// BoringSSL currently only supports one signer per `CMS_ContentInfo`.
+// Subsequent calls will fail. Additionally, only RSA keys are currently
+// supported for `pkey`.
+OPENSSL_EXPORT CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
+                                               X509 *signcert, EVP_PKEY *pkey,
+                                               const EVP_MD *md,
+                                               uint32_t flags);
+
+// CMS_final finalizes constructing `cms`, which must have been initialized with
+// the `CMS_PARTIAL` flag. `data` is read, until EOF, as the data to be
+// processed by CMS. It returns one on success and zero on error.
+//
+// `CMS_BINARY` must be set in `flags`. BoringSSL does not support translating
+// inputs according to S/MIME.
+//
+// `dcont` must be NULL. What a non-NULL `dcont` does is not clearly documented
+// by OpenSSL, and there are no tests to demonstrate its behavior.
+OPENSSL_EXPORT int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont,
+                             uint32_t flags);
+
+// i2d_CMS_bio encodes `cms` as a DER-encoded ContentInfo structure (RFC 5652).
+// It returns one on success and zero on failure.
+OPENSSL_EXPORT int i2d_CMS_bio(BIO *out, CMS_ContentInfo *cms);
+
+// i2d_CMS_bio_stream calls `i2d_CMS_bio`. `in` must be NULL and `flags` must
+// not contain `CMS_STREAM`. BoringSSL does not support any streaming modes for
+// CMS.
+OPENSSL_EXPORT int i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *in,
+                                      int flags);
+
+
+#if defined(__cplusplus)
+}  // extern C
+
+extern "C++" {
+BSSL_NAMESPACE_BEGIN
+
+BORINGSSL_MAKE_DELETER(CMS_ContentInfo, CMS_ContentInfo_free)
+
+BSSL_NAMESPACE_END
+}  // extern C++
+#endif
+
+#define CMS_R_CERTIFICATE_HAS_NO_KEYID 100
+#define CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 101
+
+#endif  // OPENSSL_HEADER_CMS_H

package/runtime/third_party/boringssl/include/openssl/conf.h

@@ -0,0 +1,136 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CONF_H
+#define OPENSSL_HEADER_CONF_H
+
+#include <openssl/base.h>   // IWYU pragma: export
+
+#include <openssl/stack.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Config files.
+//
+// This library handles OpenSSL's config files, which look like:
+//
+//   # Comment
+//
+//   # This key is in the default section.
+//   key=value
+//
+//   [section_name]
+//   key2=value2
+//
+// Config files are represented by a `CONF`. Use of this module is strongly
+// discouraged. It is a remnant of the OpenSSL command-line tool. Parsing an
+// untrusted input as a config file risks string injection and denial of service
+// vulnerabilities.
+
+
+struct conf_value_st {
+  char *section;
+  char *name;
+  char *value;
+};
+
+DEFINE_STACK_OF(CONF_VALUE)
+
+
+// NCONF_new returns a fresh, empty `CONF`, or NULL on error. The `method`
+// argument must be NULL.
+OPENSSL_EXPORT CONF *NCONF_new(void *method);
+
+// NCONF_free frees all the data owned by `conf` and then `conf` itself.
+OPENSSL_EXPORT void NCONF_free(CONF *conf);
+
+// NCONF_load parses the file named `filename` and adds the values found to
+// `conf`. It returns one on success and zero on error. In the event of an
+// error, if `out_error_line` is not NULL, `*out_error_line` is set to the
+// number of the line that contained the error.
+OPENSSL_EXPORT int NCONF_load(CONF *conf, const char *filename,
+                              long *out_error_line);
+
+// NCONF_load_bio acts like `NCONF_load` but reads from `bio` rather than from
+// a named file.
+OPENSSL_EXPORT int NCONF_load_bio(CONF *conf, BIO *bio, long *out_error_line);
+
+// NCONF_get_section returns a stack of values for a given section in `conf`.
+// If `section` is NULL, the default section is returned. It returns NULL on
+// error.
+OPENSSL_EXPORT const STACK_OF(CONF_VALUE) *NCONF_get_section(
+    const CONF *conf, const char *section);
+
+// NCONF_get_string returns the value of the key `name`, in section `section`.
+// The `section` argument may be NULL to indicate the default section. It
+// returns the value or NULL on error.
+OPENSSL_EXPORT const char *NCONF_get_string(const CONF *conf,
+                                            const char *section,
+                                            const char *name);
+
+
+// Deprecated functions
+
+// These defines do nothing but are provided to make old code easier to
+// compile.
+#define CONF_MFLAGS_DEFAULT_SECTION 0
+#define CONF_MFLAGS_IGNORE_MISSING_FILE 0
+
+// CONF_modules_load_file returns one. BoringSSL is defined to have no config
+// file options, thus loading from `filename` always succeeds by doing nothing.
+OPENSSL_EXPORT int CONF_modules_load_file(const char *filename,
+                                          const char *appname,
+                                          unsigned long flags);
+
+// CONF_modules_unload does nothing.
+OPENSSL_EXPORT void CONF_modules_unload(int all);
+
+// CONF_modules_free does nothing.
+OPENSSL_EXPORT void CONF_modules_free(void);
+
+// OPENSSL_config does nothing.
+OPENSSL_EXPORT void OPENSSL_config(const char *config_name);
+
+// OPENSSL_no_config does nothing.
+OPENSSL_EXPORT void OPENSSL_no_config(void);
+
+
+#if defined(__cplusplus)
+}  // extern C
+
+extern "C++" {
+
+BSSL_NAMESPACE_BEGIN
+
+BORINGSSL_MAKE_DELETER(CONF, NCONF_free)
+
+BSSL_NAMESPACE_END
+
+}  // extern C++
+
+#endif
+
+#define CONF_R_LIST_CANNOT_BE_NULL 100
+#define CONF_R_MISSING_CLOSE_SQUARE_BRACKET 101
+#define CONF_R_MISSING_EQUAL_SIGN 102
+#define CONF_R_NO_CLOSE_BRACE 103
+#define CONF_R_UNABLE_TO_CREATE_NEW_SECTION 104
+#define CONF_R_VARIABLE_HAS_NO_VALUE 105
+#define CONF_R_VARIABLE_EXPANSION_TOO_LONG 106
+#define CONF_R_VARIABLE_EXPANSION_NOT_SUPPORTED 107
+
+#endif  // OPENSSL_HEADER_THREAD_H

package/runtime/third_party/boringssl/include/openssl/configuration.h

@@ -0,0 +1,18 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/* This header is provided in order to make compiling against code that expects
+   OpenSSL easier. */
+
+#include "base.h"

package/runtime/third_party/boringssl/include/openssl/cpu.h

@@ -0,0 +1,18 @@
+// Copyright 2014 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This header is provided for compatibility with older revisions of BoringSSL.
+// TODO(davidben): Remove this header.
+
+#include "crypto.h"

package/runtime/third_party/boringssl/include/openssl/crypto.h

@@ -0,0 +1,235 @@
+// Copyright 2014 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_H
+#define OPENSSL_HEADER_CRYPTO_H
+
+#include <openssl/base.h>  // IWYU pragma: export
+#include <openssl/sha.h>
+
+// Upstream OpenSSL defines `OPENSSL_malloc`, etc., in crypto.h rather than
+// mem.h.
+#include <openssl/mem.h>
+
+// Upstream OpenSSL defines `CRYPTO_LOCK`, etc., in crypto.h rather than
+// thread.h.
+#include <openssl/thread.h>
+
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// crypto.h contains functions for library-wide initialization and properties.
+
+
+// CRYPTO_is_confidential_build returns one if the linked version of BoringSSL
+// has been built with the BORINGSSL_CONFIDENTIAL define and zero otherwise.
+//
+// This is used by some consumers to identify whether they are using an
+// internal version of BoringSSL.
+OPENSSL_EXPORT int CRYPTO_is_confidential_build(void);
+
+// CRYPTO_has_asm returns one unless BoringSSL was built with OPENSSL_NO_ASM,
+// in which case it returns zero.
+OPENSSL_EXPORT int CRYPTO_has_asm(void);
+
+// BORINGSSL_self_test triggers most of the FIPS KAT-based self tests. It
+// returns one on success and zero on error. It currently skips the SLH-DSA
+// tests, which take a really long time to run.
+OPENSSL_EXPORT int BORINGSSL_self_test(void);
+
+// BORINGSSL_self_test_all triggers all of the FIPS KAT-based self tests. This
+// is the 'self-test' entry point required by FIPS 140. It returns one on
+// success and zero on error. This test will take a very long time to run. You
+// probably do not want to run this in a resource or time constrained test.
+OPENSSL_EXPORT int BORINGSSL_self_test_all(void);
+
+// BORINGSSL_integrity_test triggers the module's integrity test where the code
+// and data of the module is matched against a hash injected at build time. It
+// returns one on success or zero if there's a mismatch. This function only
+// exists if the module was built in FIPS mode without ASAN.
+OPENSSL_EXPORT int BORINGSSL_integrity_test(void);
+
+// CRYPTO_pre_sandbox_init initializes the crypto library, pre-acquiring some
+// unusual resources to aid running in sandboxed environments. It is safe to
+// call this function multiple times and concurrently from multiple threads.
+//
+// For more details on using BoringSSL in a sandboxed environment, see
+// SANDBOXING.md in the source tree.
+OPENSSL_EXPORT void CRYPTO_pre_sandbox_init(void);
+
+#if defined(OPENSSL_ARM) && defined(OPENSSL_LINUX) && \
+    !defined(OPENSSL_STATIC_ARMCAP)
+// CRYPTO_needs_hwcap2_workaround returns one if the ARMv8 AArch32 AT_HWCAP2
+// workaround was needed. See https://crbug.com/boringssl/46.
+OPENSSL_EXPORT int CRYPTO_needs_hwcap2_workaround(void);
+#endif  // OPENSSL_ARM && OPENSSL_LINUX && !OPENSSL_STATIC_ARMCAP
+
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+// CRYPTO_set_fuzzer_mode, in non-production fuzzer builds, configures a "fuzzer
+// mode" in the library, which disables various signature checks and disables
+// encryption in parts of TLS.
+//
+// By default, fuzzer builds make the PRNG deterministic (and thus unsafe for
+// production), but continue to run cryptographic operations as usual. This
+// allows a fuzzer build of BoringSSL to be used dependency of fuzzer builds of
+// other libraries, without changing in semantics. This function enables further
+// incompatible changes intended for fuzzing BoringSSL itself.
+OPENSSL_EXPORT void CRYPTO_set_fuzzer_mode(int enabled);
+#endif
+
+
+// FIPS monitoring
+
+// FIPS_mode returns zero unless BoringSSL is built with BORINGSSL_FIPS, in
+// which case it returns one.
+OPENSSL_EXPORT int FIPS_mode(void);
+
+// fips_counter_t denotes specific APIs/algorithms. A counter is maintained for
+// each in FIPS mode so that tests can be written to assert that the expected,
+// FIPS functions are being called by a certain piece of code.
+enum fips_counter_t {
+  fips_counter_evp_aes_128_gcm = 0,
+  fips_counter_evp_aes_256_gcm = 1,
+  fips_counter_evp_aes_128_ctr = 2,
+  fips_counter_evp_aes_256_ctr = 3,
+
+  fips_counter_max = 3,
+};
+
+// FIPS_read_counter returns a counter of the number of times the specific
+// function denoted by `counter` has been used. This always returns zero unless
+// BoringSSL was built with BORINGSSL_FIPS_COUNTERS defined.
+OPENSSL_EXPORT size_t FIPS_read_counter(enum fips_counter_t counter);
+
+
+// Deprecated functions.
+
+// OPENSSL_VERSION_TEXT contains a string the identifies the version of
+// “OpenSSL”. node.js requires a version number in this text.
+#define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1 (compatible; BoringSSL)"
+
+#define OPENSSL_VERSION 0
+#define OPENSSL_CFLAGS 1
+#define OPENSSL_BUILT_ON 2
+#define OPENSSL_PLATFORM 3
+#define OPENSSL_DIR 4
+
+// OpenSSL_version is a compatibility function that returns the string
+// "BoringSSL" if `which` is `OPENSSL_VERSION` and placeholder strings
+// otherwise.
+OPENSSL_EXPORT const char *OpenSSL_version(int which);
+
+#define SSLEAY_VERSION OPENSSL_VERSION
+#define SSLEAY_CFLAGS OPENSSL_CFLAGS
+#define SSLEAY_BUILT_ON OPENSSL_BUILT_ON
+#define SSLEAY_PLATFORM OPENSSL_PLATFORM
+#define SSLEAY_DIR OPENSSL_DIR
+
+// SSLeay_version calls `OpenSSL_version`.
+OPENSSL_EXPORT const char *SSLeay_version(int which);
+
+// SSLeay is a compatibility function that returns OPENSSL_VERSION_NUMBER from
+// base.h.
+OPENSSL_EXPORT unsigned long SSLeay(void);
+
+// OpenSSL_version_num is a compatibility function that returns
+// OPENSSL_VERSION_NUMBER from base.h.
+OPENSSL_EXPORT unsigned long OpenSSL_version_num(void);
+
+// CRYPTO_malloc_init returns one.
+OPENSSL_EXPORT int CRYPTO_malloc_init(void);
+
+// OPENSSL_malloc_init returns one.
+OPENSSL_EXPORT int OPENSSL_malloc_init(void);
+
+// ENGINE_load_builtin_engines does nothing.
+OPENSSL_EXPORT void ENGINE_load_builtin_engines(void);
+
+// ENGINE_register_all_complete returns one.
+OPENSSL_EXPORT int ENGINE_register_all_complete(void);
+
+// ENGINE_cleanup does nothing.
+OPENSSL_EXPORT void ENGINE_cleanup(void);
+
+// OPENSSL_load_builtin_modules does nothing.
+OPENSSL_EXPORT void OPENSSL_load_builtin_modules(void);
+
+// OPENSSL_INIT_* are options in OpenSSL to configure the library. In BoringSSL,
+// they do nothing.
+#define OPENSSL_INIT_NO_LOAD_CRYPTO_STRINGS 0
+#define OPENSSL_INIT_LOAD_CRYPTO_STRINGS 0
+#define OPENSSL_INIT_ADD_ALL_CIPHERS 0
+#define OPENSSL_INIT_ADD_ALL_DIGESTS 0
+#define OPENSSL_INIT_NO_ADD_ALL_CIPHERS 0
+#define OPENSSL_INIT_NO_ADD_ALL_DIGESTS 0
+#define OPENSSL_INIT_LOAD_CONFIG 0
+#define OPENSSL_INIT_NO_LOAD_CONFIG 0
+#define OPENSSL_INIT_NO_ATEXIT 0
+#define OPENSSL_INIT_ATFORK 0
+#define OPENSSL_INIT_ENGINE_RDRAND 0
+#define OPENSSL_INIT_ENGINE_DYNAMIC 0
+#define OPENSSL_INIT_ENGINE_OPENSSL 0
+#define OPENSSL_INIT_ENGINE_CRYPTODEV 0
+#define OPENSSL_INIT_ENGINE_CAPI 0
+#define OPENSSL_INIT_ENGINE_PADLOCK 0
+#define OPENSSL_INIT_ENGINE_AFALG 0
+#define OPENSSL_INIT_ENGINE_ALL_BUILTIN 0
+
+// OPENSSL_init_crypto returns one.
+OPENSSL_EXPORT int OPENSSL_init_crypto(uint64_t opts,
+                                       const OPENSSL_INIT_SETTINGS *settings);
+
+// OPENSSL_cleanup does nothing.
+OPENSSL_EXPORT void OPENSSL_cleanup(void);
+
+// FIPS_mode_set returns one if `on` matches whether BoringSSL was built with
+// `BORINGSSL_FIPS` and zero otherwise.
+OPENSSL_EXPORT int FIPS_mode_set(int on);
+
+// FIPS_module_name returns the name of the FIPS module.
+OPENSSL_EXPORT const char *FIPS_module_name(void);
+
+// FIPS_module_hash returns the 32-byte hash of the FIPS module.
+OPENSSL_EXPORT const uint8_t *FIPS_module_hash(void);
+
+// FIPS_version returns the version of the FIPS module, or zero if the build
+// isn't exactly at a verified version. The version, expressed in base 10, will
+// be a date in the form yyyymmdd.
+//
+// (This format exceeds a `uint32_t` in the year 4294.)
+OPENSSL_EXPORT uint32_t FIPS_version(void);
+
+// FIPS_query_algorithm_status returns one if `algorithm` is FIPS validated in
+// the current BoringSSL and zero otherwise.
+OPENSSL_EXPORT int FIPS_query_algorithm_status(const char *algorithm);
+
+#if defined(OPENSSL_ARM) && defined(OPENSSL_LINUX) && \
+    !defined(OPENSSL_STATIC_ARMCAP)
+// CRYPTO_has_broken_NEON returns zero.
+OPENSSL_EXPORT int CRYPTO_has_broken_NEON(void);
+#endif
+
+// CRYPTO_library_init does nothing. Historically, it was needed in some build
+// configurations to initialization the library. This is no longer necessary.
+OPENSSL_EXPORT void CRYPTO_library_init(void);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_H