update master-with-bazel from master branch

src/crypto/hpke/hpke_test.cc

@@ -34,7 +34,7 @@
 #include "../test/test_util.h"
 
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 const decltype(&EVP_hpke_aes_128_gcm) kAllAEADs[] = {
@@ -635,5 +635,4 @@ TEST(HPKETest, InternalParseIntSafe) {
   ASSERT_FALSE(ParseIntSafe(&u16, "65536"));
 }
 
-
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/include/openssl/pki/certificate.h

@@ -22,7 +22,7 @@
 #include <openssl/base.h>
 #include <openssl/span.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 struct CertificateInternals;
 
@@ -78,6 +78,6 @@ class OPENSSL_EXPORT Certificate {
   std::unique_ptr<CertificateInternals> internals_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_BSSL_PKI_CERTIFICATE_H_ && __cplusplus

src/include/openssl/pki/signature_verify_cache.h

@@ -8,7 +8,7 @@
 #include <openssl/base.h>
 #include <string>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class OPENSSL_EXPORT SignatureVerifyCache {
  public:
@@ -36,6 +36,6 @@ class OPENSSL_EXPORT SignatureVerifyCache {
   virtual Value Check(const std::string &key) = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_SIGNATURE_VERIFY_CACHE_H_ && __cplusplus

src/include/openssl/pki/verify.h

@@ -10,7 +10,8 @@
 #include <openssl/pki/signature_verify_cache.h>
 #include <openssl/pki/verify_error.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
+
 class CertIssuerSourceStatic;
 class TrustStoreInMemory;
 class CertificateVerifyOptions;
@@ -165,6 +166,6 @@ OPENSSL_EXPORT std::optional<std::vector<std::string>> CertificateVerify(
 OPENSSL_EXPORT std::optional<std::vector<std::vector<std::string>>>
 CertificateVerifyAllPaths(const CertificateVerifyOptions &opts);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_VERIFY_H_

src/include/openssl/pki/verify_error.h

@@ -15,10 +15,11 @@
 #if !defined(OPENSSL_HEADER_BSSL_PKI_VERIFY_ERROR_H_) && defined(__cplusplus)
 #define OPENSSL_HEADER_BSSL_PKI_VERIFY_ERROR_H_
 
-#include <string>
-#include <string_view>
+#include <openssl/base.h>
 
-namespace bssl {
+#include <string>
+
+BSSL_NAMESPACE_BEGIN
 
 // VerifyError describes certificate chain validation result.
 class OPENSSL_EXPORT VerifyError {
@@ -132,6 +133,6 @@ class OPENSSL_EXPORT VerifyError {
   std::string diagnostic_;
 };
 
-} // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_BSSL_PKI_VERIFY_ERROR_H_

src/include/openssl/service_indicator.h

@@ -56,7 +56,7 @@ extern "C++" {
     return func;                                                \
   }()
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 enum class FIPSStatus {
   NOT_APPROVED = 0,
@@ -87,7 +87,7 @@ class FIPSIndicatorHelper {
   const uint64_t before_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 }  // extern "C++"
 
 #endif  // !BORINGSSL_NO_CXX

src/pki/cert_error_id.cc

@@ -4,11 +4,11 @@
 
 #include "cert_error_id.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 const char *CertErrorIdToDebugString(CertErrorId id) {
   // The CertErrorId is simply a pointer for a C-string literal.
   return reinterpret_cast<const char *>(id);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/cert_error_id.h

@@ -7,7 +7,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Each "class" of certificate error/warning has its own unique ID. This is
 // essentially like an error code, however the value is not stable. Under the
@@ -32,6 +32,6 @@ using CertErrorId = const void *;
 // string literal given to DEFINE_CERT_ERROR_ID(), which is human-readable.
 OPENSSL_EXPORT const char *CertErrorIdToDebugString(CertErrorId id);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ERROR_ID_H_

src/pki/cert_error_params.cc

@@ -11,7 +11,7 @@
 #include "input.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -132,4 +132,4 @@ OPENSSL_EXPORT std::unique_ptr<CertErrorParams> CreateCertErrorParams2SizeT(
   return std::make_unique<CertErrorParams2SizeT>(name1, value1, name2, value2);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/cert_error_params.h

@@ -10,7 +10,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class Input;
@@ -54,6 +54,6 @@ OPENSSL_EXPORT std::unique_ptr<CertErrorParams> CreateCertErrorParams1SizeT(
 OPENSSL_EXPORT std::unique_ptr<CertErrorParams> CreateCertErrorParams2SizeT(
     const char *name1, size_t value1, const char *name2, size_t value2);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ERROR_PARAMS_H_

src/pki/cert_errors.cc

@@ -10,7 +10,7 @@
 
 #include <sstream>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -232,4 +232,4 @@ std::string CertPathErrors::ToDebugString(
   return result.str();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/cert_errors.h

@@ -54,7 +54,7 @@
 #include "cert_error_id.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrorParams;
 class CertPathErrors;
@@ -176,6 +176,6 @@ class OPENSSL_EXPORT CertPathErrors {
   CertErrors other_errors_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ERRORS_H_

src/pki/cert_issuer_source.h

@@ -12,7 +12,7 @@
 
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Interface for looking up issuers of a certificate during path building.
 // Provides a synchronous and asynchronous method for retrieving issuers, so the
@@ -63,6 +63,6 @@ class OPENSSL_EXPORT CertIssuerSource {
                                  std::unique_ptr<Request> *out_req) = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ISSUER_SOURCE_H_

src/pki/cert_issuer_source_static.cc

@@ -4,7 +4,7 @@
 
 #include "cert_issuer_source_static.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 CertIssuerSourceStatic::CertIssuerSourceStatic() = default;
 CertIssuerSourceStatic::~CertIssuerSourceStatic() = default;
@@ -42,4 +42,4 @@ void CertIssuerSourceStatic::AsyncGetIssuersOf(
   out_req->reset();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/cert_issuer_source_static.h

@@ -12,7 +12,7 @@
 
 #include "cert_issuer_source.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Synchronously returns issuers from a pre-supplied set.
 class OPENSSL_EXPORT CertIssuerSourceStatic : public CertIssuerSource {
@@ -50,6 +50,6 @@ class OPENSSL_EXPORT CertIssuerSourceStatic : public CertIssuerSource {
       intermediates_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ISSUER_SOURCE_STATIC_H_

src/pki/cert_issuer_source_static_unittest.cc

@@ -9,7 +9,7 @@
 #include "cert_issuer_source_sync_unittest.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -72,4 +72,4 @@ TEST(CertIssuerSourceStaticTest, AddCertsGetCertsAndClear) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/cert_issuer_source_sync_unittest.h

@@ -13,7 +13,7 @@
 #include "cert_issuer_source.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -211,6 +211,6 @@ TYPED_TEST_P(CertIssuerSourceSyncNotNormalizedTest,
 REGISTER_TYPED_TEST_SUITE_P(CertIssuerSourceSyncNotNormalizedTest,
                             OneMatchWithoutNormalization);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ISSUER_SOURCE_SYNC_UNITTEST_H_

src/pki/certificate.cc

@@ -24,7 +24,7 @@
 #include "pem.h"
 #include "parse_values.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -114,4 +114,4 @@ bssl::Span<const uint8_t> Certificate::GetSerialNumber() const {
   return internals_->cert->tbs().serial_number;
 }
 
-}  // namespace boringssl
+BSSL_NAMESPACE_END

src/pki/certificate_policies.cc

@@ -13,7 +13,7 @@
 #include "parse_values.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -388,4 +388,4 @@ bool ParsePolicyMappings(der::Input policy_mappings_tlv,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/certificate_policies.h

@@ -12,7 +12,7 @@
 #include <optional>
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -123,6 +123,6 @@ struct ParsedPolicyMapping {
 [[nodiscard]] OPENSSL_EXPORT bool ParsePolicyMappings(
     der::Input policy_mappings_tlv, std::vector<ParsedPolicyMapping> *mappings);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERTIFICATE_POLICIES_H_

src/pki/certificate_policies_unittest.cc

@@ -9,7 +9,7 @@
 #include "parser.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 ::testing::AssertionResult LoadTestData(const std::string &name,
@@ -309,4 +309,4 @@ TEST(ParseCertificatePoliciesExtensionTest, TwoPoliciesWithQualifiers) {
 // parsed_certificate_unittest.cc
 
 }  // namespace
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/common_cert_errors.cc

@@ -4,7 +4,8 @@
 
 #include "common_cert_errors.h"
 
-namespace bssl::cert_errors {
+BSSL_NAMESPACE_BEGIN
+namespace cert_errors {
 
 DEFINE_CERT_ERROR_ID(kInternalError, "Internal error");
 DEFINE_CERT_ERROR_ID(kValidityFailedNotAfter, "Time is after notAfter");
@@ -79,4 +80,5 @@ DEFINE_CERT_ERROR_ID(kDeadlineExceeded, "Deadline exceeded");
 DEFINE_CERT_ERROR_ID(kIterationLimitExceeded, "Iteration limit exceeded");
 DEFINE_CERT_ERROR_ID(kDepthLimitExceeded, "Depth limit exceeded");
 
-}  // namespace bssl::cert_errors
+}  // namespace cert_errors
+BSSL_NAMESPACE_END

src/pki/common_cert_errors.h

@@ -13,7 +13,8 @@
 // defined by the core verification/path building code).
 //
 // Errors may be defined for other domains.
-namespace bssl::cert_errors {
+BSSL_NAMESPACE_BEGIN
+namespace cert_errors {
 
 // An internal error occurred which prevented path building or verification
 // from finishing.
@@ -155,6 +156,7 @@ OPENSSL_EXPORT extern const CertErrorId kIterationLimitExceeded;
 // Depth limit was reached during path building.
 OPENSSL_EXPORT extern const CertErrorId kDepthLimitExceeded;
 
-}  // namespace bssl::cert_errors
+}  // namespace cert_errors
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_COMMON_CERT_ERRORS_H_

src/pki/crl.cc

@@ -18,7 +18,7 @@
 #include "verify_name_match.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -670,4 +670,4 @@ CRLRevocationStatus CheckCRL(std::string_view raw_crl,
   return CRLRevocationStatus::UNKNOWN;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/crl.h

@@ -14,7 +14,7 @@
 #include "parse_values.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 struct ParsedCrlTbsCertList;
 struct ParsedDistributionPoint;
@@ -215,6 +215,6 @@ GetCRLStatusForCert(der::Input cert_serial, CrlVersion crl_version,
     size_t target_cert_index, const ParsedDistributionPoint &cert_dp,
     int64_t verify_time_epoch_seconds, std::optional<int64_t> max_age_seconds);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CRL_H_

src/pki/crl_unittest.cc

@@ -13,7 +13,7 @@
 #include "string_util.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -205,4 +205,4 @@ TEST_P(CheckCRLTest, FromFile) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/encode_values.cc

@@ -8,7 +8,8 @@
 
 #include <openssl/posix_time.h>
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 namespace {
 
@@ -104,4 +105,5 @@ bool EncodeUTCTime(const GeneralizedTime &time, uint8_t out[kUTCTimeLength]) {
   return true;
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END

src/pki/encode_values.h

@@ -10,7 +10,8 @@
 
 #include <openssl/base.h>
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 struct GeneralizedTime;
 
@@ -40,6 +41,7 @@ static const size_t kUTCTimeLength = 13;
 OPENSSL_EXPORT bool EncodeUTCTime(const GeneralizedTime &time,
                                   uint8_t out[kUTCTimeLength]);
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_ENCODE_VALUES_H_

src/pki/encode_values_unittest.cc

@@ -9,7 +9,8 @@
 #include <gtest/gtest.h>
 #include "parse_values.h"
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 namespace {
 
@@ -166,4 +167,5 @@ TEST(EncodeValuesTest, EncodeUTCTime) {
   EXPECT_FALSE(EncodeUTCTime(time, out));
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END

src/pki/extended_key_usage.cc

@@ -9,7 +9,7 @@
 #include "input.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 bool ParseEKUExtension(der::Input extension_value,
                        std::vector<der::Input> *eku_oids) {
@@ -42,4 +42,4 @@ bool ParseEKUExtension(der::Input extension_value,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/extended_key_usage.h

@@ -11,7 +11,7 @@
 
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // The arc for the anyExtendedKeyUsage OID is found under the id-ce arc,
 // defined in section 4.2.1 of RFC 5280:
@@ -78,6 +78,6 @@ inline constexpr uint8_t kOCSPSigning[] = {0x2b, 0x06, 0x01, 0x05,
 OPENSSL_EXPORT bool ParseEKUExtension(der::Input extension_value,
                                       std::vector<der::Input> *eku_oids);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_EXTENDED_KEY_USAGE_H_

src/pki/extended_key_usage_unittest.cc

@@ -8,7 +8,7 @@
 #include "extended_key_usage.h"
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -164,4 +164,4 @@ TEST(ExtendedKeyUsageTest, EmptyExtension) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/general_names.cc

@@ -17,7 +17,7 @@
 #include "parser.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 DEFINE_CERT_ERROR_ID(kFailedParsingGeneralName, "Failed parsing GeneralName");
 
@@ -216,4 +216,4 @@ std::unique_ptr<GeneralNames> GeneralNames::CreateFromValue(
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/general_names.h

@@ -14,7 +14,7 @@
 
 #include "cert_error_id.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -126,6 +126,6 @@ struct OPENSSL_EXPORT GeneralNames {
     GeneralNames::ParseGeneralNameIPAddressType ip_address_type,
     GeneralNames *subtrees, CertErrors *errors);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_GENERAL_NAMES_H_

src/pki/general_names_unittest.cc

@@ -7,7 +7,7 @@
 #include <gtest/gtest.h>
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 ::testing::AssertionResult LoadTestData(const char *token,
@@ -223,4 +223,4 @@ TEST(GeneralNames, RegisteredIDs) {
   EXPECT_EQ(der::Input(expected_der), general_names->registered_ids[0]);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/input.cc

@@ -4,9 +4,8 @@
 
 #include "input.h"
 
-#include <openssl/base.h>
-
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 std::string Input::AsString() const { return std::string(AsStringView()); }
 
@@ -42,4 +41,5 @@ void ByteReader::Advance(size_t len) {
   data_ = data_.subspan(len);
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END

src/pki/input.h

@@ -22,9 +22,11 @@
 
 #if defined(__cpp_lib_ranges) && __cpp_lib_ranges >= 201911L
 #include <ranges>
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 class OPENSSL_EXPORT Input;
 }
+BSSL_NAMESPACE_END
 
 // Mark `Input` as satisfying the `view` and `borrowed_range` concepts. This
 // should be done before the definition of `Input`, so that any inlined calls to
@@ -36,7 +38,8 @@ inline constexpr bool std::ranges::enable_borrowed_range<bssl::der::Input> =
     true;
 #endif
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 // An opaque class that represents a fixed buffer of data of a fixed length,
 // to be used as an input to other operations. An Input object does not own
@@ -188,6 +191,7 @@ class OPENSSL_EXPORT ByteReader {
   bssl::Span<const uint8_t> data_;
 };
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_INPUT_H_

src/pki/input_unittest.cc

@@ -6,7 +6,8 @@
 
 #include <gtest/gtest.h>
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 constexpr uint8_t kInput[] = {'t', 'e', 's', 't'};
 const uint8_t kInput2[] = {'t', 'e', 'a', 'l'};
@@ -104,4 +105,5 @@ TEST(ByteReaderTest, HasMore) {
   ASSERT_FALSE(reader.HasMore());
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END

src/pki/ip_util.cc

@@ -4,7 +4,7 @@
 
 #include "ip_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 bool IsValidNetmask(der::Input mask) {
   if (mask.size() != kIPv4AddressSize && mask.size() != kIPv6AddressSize) {
@@ -46,4 +46,4 @@ bool IPAddressMatchesWithNetmask(der::Input addr1, der::Input addr2,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/ip_util.h

@@ -9,7 +9,7 @@
 
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 inline constexpr size_t kIPv4AddressSize = 4;
 inline constexpr size_t kIPv6AddressSize = 16;
@@ -24,6 +24,6 @@ OPENSSL_EXPORT bool IPAddressMatchesWithNetmask(der::Input addr1,
                                                 der::Input addr2,
                                                 der::Input mask);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_IP_UTIL_H_

src/pki/ip_util_unittest.cc

@@ -9,7 +9,7 @@
 #include <gtest/gtest.h>
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TEST(IPUtilTest, IsValidNetmask) {
   uint8_t kWrongSize[3] = {0xff, 0xff, 0xff};
@@ -104,4 +104,4 @@ TEST(IPUtilTest, IPAddressMatchesWithNetmask) {
   }
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/mock_signature_verify_cache.cc

@@ -6,7 +6,7 @@
 
 #include <algorithm>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 MockSignatureVerifyCache::MockSignatureVerifyCache() = default;
 
@@ -29,4 +29,4 @@ SignatureVerifyCache::Value MockSignatureVerifyCache::Check(
   return iter->second;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/mock_signature_verify_cache.h

@@ -13,7 +13,7 @@
 
 #include <openssl/pki/signature_verify_cache.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // MockSignatureVerifyCache is an implementation of SignatureVerifyCache.  It is
 // intended only for testing of cache functionality.
@@ -42,6 +42,6 @@ class MockSignatureVerifyCache : public SignatureVerifyCache {
   size_t stores_ = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_MOCK_PATH_BUILDER_DELEGATE_H_

src/pki/name_constraints.cc

@@ -21,7 +21,7 @@
 #include "string_util.h"
 #include "verify_name_match.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -707,4 +707,4 @@ bool NameConstraints::IsPermittedIP(der::Input ip) const {
   return false;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/name_constraints.h

@@ -11,7 +11,7 @@
 
 #include "general_names.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -101,6 +101,6 @@ class OPENSSL_EXPORT NameConstraints {
   int constrained_name_types_ = GENERAL_NAME_NONE;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_NAME_CONSTRAINTS_H_

src/pki/name_constraints_unittest.cc

@@ -11,7 +11,7 @@
 #include "common_cert_errors.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 ::testing::AssertionResult LoadTestData(const char *token,
@@ -1901,4 +1901,4 @@ TEST_P(ParseNameConstraints, IsPermittedCertSubjectIpAddresses) {
                               nullptr /* subject_alt_names */));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/nist_pkits_unittest.cc

@@ -8,7 +8,7 @@
 
 #include <sstream>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -97,4 +97,4 @@ void PkitsTestInfo::SetUserConstrainedPolicySet(
   SetPolicySetFromString(policy_names, &user_constrained_policy_set);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/nist_pkits_unittest.h

@@ -11,7 +11,7 @@
 #include "parse_values.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Describes the inputs and outputs (other than the certificates) for
 // the PKITS tests.
@@ -144,6 +144,6 @@ class PkitsTest : public ::testing::Test {
 // Inline the generated test code:
 #include "testdata/nist-pkits/pkits_testcases-inl.h"
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_NIST_PKITS_UNITTEST_H_

src/pki/ocsp.cc

@@ -17,7 +17,7 @@
 #include "verify_name_match.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 OCSPCertID::OCSPCertID() = default;
 OCSPCertID::~OCSPCertID() = default;
@@ -1120,4 +1120,4 @@ std::optional<std::string> CreateOCSPGetURL(
   return std::string(ocsp_responder_url) + "/" + b64_encoded;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/ocsp.h

@@ -19,7 +19,7 @@
 #include "parser.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class ParsedCertificate;
 
@@ -310,6 +310,6 @@ OPENSSL_EXPORT std::optional<std::string> CreateOCSPGetURL(
     const ParsedCertificate *cert, const ParsedCertificate *issuer,
     std::string_view ocsp_responder_url);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_OCSP_H_

src/pki/ocsp_revocation_status.h

@@ -5,7 +5,7 @@
 #ifndef BSSL_PKI_OCSP_REVOCATION_STATUS_H_
 #define BSSL_PKI_OCSP_REVOCATION_STATUS_H_
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // This value is histogrammed, so do not re-order or change values, and add
 // new values at the end.
@@ -16,6 +16,6 @@ enum class OCSPRevocationStatus {
   MAX_VALUE = UNKNOWN
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_OCSP_REVOCATION_STATUS_H_

src/pki/ocsp_unittest.cc

@@ -11,7 +11,7 @@
 #include "string_util.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -239,4 +239,4 @@ TEST_P(CreateOCSPGetURLTest, Basic) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/ocsp_verify_result.cc

@@ -4,7 +4,7 @@
 
 #include "ocsp_verify_result.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 OCSPVerifyResult::OCSPVerifyResult() = default;
 OCSPVerifyResult::OCSPVerifyResult(const OCSPVerifyResult &) = default;
@@ -22,4 +22,4 @@ bool OCSPVerifyResult::operator==(const OCSPVerifyResult &other) const {
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/ocsp_verify_result.h

@@ -9,7 +9,7 @@
 
 #include "ocsp_revocation_status.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // The result of OCSP verification. This always contains a ResponseStatus, which
 // describes whether or not an OCSP response was provided, and response level
@@ -71,6 +71,6 @@ struct OPENSSL_EXPORT OCSPVerifyResult {
   OCSPRevocationStatus revocation_status = OCSPRevocationStatus::UNKNOWN;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_OCSP_VERIFY_RESULT_H_

src/pki/parse_certificate.cc

@@ -18,7 +18,7 @@
 #include "parser.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1013,4 +1013,4 @@ bool ParseSubjectKeyIdentifier(der::Input extension_value,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/parse_certificate.h

@@ -18,7 +18,7 @@
 #include "input.h"
 #include "parse_values.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class Parser;
@@ -625,6 +625,6 @@ struct OPENSSL_EXPORT ParsedAuthorityKeyIdentifier {
 [[nodiscard]] OPENSSL_EXPORT bool ParseSubjectKeyIdentifier(
     der::Input extension_value, der::Input *subject_key_identifier);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PARSE_CERTIFICATE_H_

src/pki/parse_certificate_unittest.cc

@@ -12,7 +12,7 @@
 #include "parsed_certificate.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1173,4 +1173,4 @@ TEST(ParseSubjectKeyIdentifierTest, ExtraData) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/parse_name.cc

@@ -12,7 +12,7 @@
 #include "parse_values.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -231,4 +231,4 @@ bool ConvertToRFC2253(const RDNSequence &rdn_sequence, std::string *out) {
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/parse_name.h

@@ -13,7 +13,7 @@
 #include "input.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // id-at-commonName: 2.5.4.3 (RFC 5280)
 inline constexpr uint8_t kTypeCommonNameOid[] = {0x55, 0x04, 0x03};
@@ -152,6 +152,6 @@ typedef std::vector<RelativeDistinguishedName> RDNSequence;
 // successful.
 [[nodiscard]] OPENSSL_EXPORT bool ConvertToRFC2253(
     const RDNSequence &rdn_sequence, std::string *out);
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PARSE_NAME_H_

src/pki/parse_name_unittest.cc

@@ -7,7 +7,7 @@
 #include <gtest/gtest.h>
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 // Loads test data from file. The filename is constructed from the parameters:
@@ -363,4 +363,4 @@ TEST(ParseNameTest, RFC2253FormatUTF8) {
   ASSERT_EQ("SN=Lu\\C4\\8Di\\C4\\87", output);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/parse_values.cc

@@ -12,7 +12,8 @@
 #include <openssl/bytestring.h>
 #include <openssl/mem.h>
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 namespace {
 
@@ -470,4 +471,5 @@ bool ParseBmpString(Input in, std::string *out) {
   return true;
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END

src/pki/parse_values.h

@@ -13,7 +13,8 @@
 
 #include "input.h"
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 // Reads a DER-encoded ASN.1 BOOLEAN value from |in| and puts the resulting
 // value in |out|. Returns whether the encoded value could successfully be
@@ -149,6 +150,7 @@ OPENSSL_EXPORT bool operator>=(const GeneralizedTime &lhs,
 // result in |out| as UTF-8, returning true if successful.
 [[nodiscard]] OPENSSL_EXPORT bool ParseBmpString(Input in, std::string *out);
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_PARSE_VALUES_H_

src/pki/parse_values_unittest.cc

@@ -8,7 +8,8 @@
 
 #include <gtest/gtest.h>
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 namespace {
 
@@ -461,4 +462,5 @@ TEST(ParseValuesTest, ParseUniversalString) {
       ParseUniversalString(der::Input(invalid_non_4_multiple_der), &s));
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END

src/pki/parsed_certificate.cc

@@ -15,7 +15,7 @@
 #include "signature_algorithm.h"
 #include "verify_name_match.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -295,4 +295,4 @@ bool ParsedCertificate::CreateAndAddToVector(
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/parsed_certificate.h

@@ -17,7 +17,7 @@
 #include "parse_certificate.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 struct GeneralNames;
 class NameConstraints;
@@ -323,6 +323,6 @@ class OPENSSL_EXPORT ParsedCertificate {
   ExtensionsMap extensions_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PARSED_CERTIFICATE_H_

src/pki/parsed_certificate_unittest.cc

@@ -13,7 +13,7 @@
 
 // TODO(eroman): Add tests for parsing of policy mappings.
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -594,4 +594,4 @@ TEST(ParsedCertificateTest, AuthourityKeyIdentifierNotSequence) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/parser.cc

@@ -4,10 +4,10 @@
 
 #include "parser.h"
 
-#include <openssl/base.h>
 #include "parse_values.h"
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 Parser::Parser() { CBS_init(&cbs_, nullptr, 0); }
 
@@ -157,4 +157,5 @@ bool Parser::ReadGeneralizedTime(GeneralizedTime *out) {
   return ParseGeneralizedTime(value, out);
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END

src/pki/parser.h

@@ -14,7 +14,8 @@
 
 #include "input.h"
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 class BitString;
 struct GeneralizedTime;
@@ -207,6 +208,7 @@ class OPENSSL_EXPORT Parser {
   size_t advance_len_ = 0;
 };
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_PARSER_H_

src/pki/parser_unittest.cc

@@ -8,7 +8,8 @@
 #include "input.h"
 #include "parse_values.h"
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 TEST(ParserTest, ConsumesAllBytesOfTLV) {
   const uint8_t der[] = {0x04 /* OCTET STRING */, 0x00};
@@ -362,4 +363,5 @@ TEST(ParserTest, ReadBitStringBadTag) {
   EXPECT_FALSE(bit_string.has_value());
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END

src/pki/path_builder.cc

@@ -24,7 +24,7 @@
 #include "verify_certificate_chain.h"
 #include "verify_name_match.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1044,4 +1044,4 @@ void CertPathBuilder::AddResultPath(
   out_result_.paths.push_back(std::move(result_path));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/path_builder.h

@@ -18,7 +18,7 @@
 #include "trust_store.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 struct GeneralizedTime;
@@ -258,6 +258,6 @@ class OPENSSL_EXPORT CertPathBuilder {
   size_t valid_path_count_ = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PATH_BUILDER_H_

src/pki/path_builder_pkits_unittest.cc

@@ -22,7 +22,7 @@
 
 constexpr int64_t kOneYear = 60 * 60 * 24 * 365;
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -289,4 +289,4 @@ INSTANTIATE_TYPED_TEST_SUITE_P(PathBuilder,
                                PkitsTest16PrivateCertificateExtensions,
                                PathBuilderPkitsTestDelegate);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/path_builder_unittest.cc

@@ -22,7 +22,7 @@
 #include <gtest/gtest.h>
 #include <openssl/pool.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // TODO(crbug.com/634443): Assert the errors for each ResultPath.
 
@@ -2921,4 +2921,4 @@ TEST(PathBuilderPrioritizationTest, SelfIssuedPrioritization) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/path_builder_verify_certificate_chain_unittest.cc

@@ -9,7 +9,7 @@
 #include "trust_store_in_memory.h"
 #include "verify_certificate_chain_typed_unittest.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -53,4 +53,4 @@ INSTANTIATE_TYPED_TEST_SUITE_P(PathBuilder,
                                VerifyCertificateChainSingleRootTest,
                                PathBuilderTestDelegate);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/pem.cc

@@ -15,7 +15,7 @@ constexpr std::string_view kPEMHeaderTail = "-----";
 
 }  // namespace
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 
 
@@ -140,4 +140,4 @@ std::string PEMEncode(std::string_view data, const std::string &type) {
   return pem_encoded;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/pem.h

@@ -13,7 +13,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // PEMTokenizer is a utility class for the parsing of data encapsulated
 // using RFC 1421, Privacy Enhancement for Internet Electronic Mail. It
@@ -81,6 +81,6 @@ class OPENSSL_EXPORT PEMTokenizer {
 OPENSSL_EXPORT std::string PEMEncode(std::string_view data,
                                      const std::string &type);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PEM_H_

src/pki/pem_unittest.cc

@@ -6,7 +6,7 @@
 
 #include <gtest/gtest.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TEST(PEMTokenizerTest, BasicParsing) {
   const char data[] =
@@ -202,4 +202,4 @@ TEST(PEMEncodeTest, Wrapping) {
                 "WRAPPED LINE"));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/revocation_util.cc

@@ -7,7 +7,7 @@
 #include "encode_values.h"
 #include "parse_values.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -56,4 +56,4 @@ bool CheckRevocationDateValid(const der::GeneralizedTime &this_update,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/revocation_util.h

@@ -10,7 +10,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 struct GeneralizedTime;
@@ -26,6 +26,6 @@ struct GeneralizedTime;
     const der::GeneralizedTime *next_update, int64_t verify_time_epoch_seconds,
     std::optional<int64_t> max_age_seconds);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_REVOCATION_UTIL_H_

src/pki/signature_algorithm.cc

@@ -11,7 +11,7 @@
 #include "parse_values.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -422,4 +422,4 @@ std::optional<DigestAlgorithm> GetTlsServerEndpointDigestAlgorithm(
   return std::nullopt;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/signature_algorithm.h

@@ -12,7 +12,7 @@
 #include <openssl/base.h>
 #include <openssl/evp.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class Input;
@@ -81,6 +81,6 @@ OPENSSL_EXPORT std::optional<SignatureAlgorithm> ParseSignatureAlgorithm(
 OPENSSL_EXPORT std::optional<DigestAlgorithm>
 GetTlsServerEndpointDigestAlgorithm(SignatureAlgorithm alg);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_SIGNATURE_ALGORITHM_H_

src/pki/signature_algorithm_unittest.cc

@@ -10,7 +10,7 @@
 #include "input.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1448,4 +1448,4 @@ TEST(SignatureAlgorithmTest, ParseDerDsaWithSha256NoParams) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/simple_path_builder_delegate.cc

@@ -19,7 +19,7 @@
 #include "signature_algorithm.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 DEFINE_CERT_ERROR_ID(SimplePathBuilderDelegate::kRsaModulusTooSmall,
                      "RSA modulus too small");
@@ -127,4 +127,4 @@ bool SimplePathBuilderDelegate::IsPublicKeyAcceptable(EVP_PKEY *public_key,
   return false;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/simple_path_builder_delegate.h

@@ -13,7 +13,7 @@
 #include "path_builder.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -78,6 +78,6 @@ class OPENSSL_EXPORT SimplePathBuilderDelegate
   const DigestPolicy digest_policy_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_SIMPLE_PATH_BUILDER_DELEGATE_H_

src/pki/simple_path_builder_delegate_unittest.cc

@@ -16,7 +16,7 @@
 #include "test_helpers.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -103,4 +103,4 @@ TEST_P(SimplePathBuilderDelegate2048FailTest, RsaKeySmallerThan2048) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/string_util.cc

@@ -12,7 +12,8 @@
 #include <openssl/base64.h>
 #include <openssl/mem.h>
 
-namespace bssl::string_util {
+BSSL_NAMESPACE_BEGIN
+namespace string_util {
 
 bool IsAscii(std::string_view str) {
   for (unsigned char c : str) {
@@ -190,4 +191,5 @@ bool Base64Decode(const std::string_view &input, std::string *output) {
   return true;
 }
 
-}  // namespace bssl::string_util
+}  // namespace string_util
+BSSL_NAMESPACE_END

src/pki/string_util.h

@@ -13,7 +13,8 @@
 #include <openssl/base.h>
 #include <openssl/span.h>
 
-namespace bssl::string_util {
+BSSL_NAMESPACE_BEGIN
+namespace string_util {
 
 // Returns true if the characters in |str| are all ASCII, false otherwise.
 OPENSSL_EXPORT bool IsAscii(std::string_view str);
@@ -70,6 +71,7 @@ OPENSSL_EXPORT bool Base64Encode(const std::string_view &input,
 OPENSSL_EXPORT bool Base64Decode(const std::string_view &input,
                                  std::string *output);
 
-}  // namespace bssl::string_util
+}  // namespace string_util
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_STRING_UTIL_H_

src/pki/string_util_unittest.cc

@@ -5,7 +5,7 @@
 #include "string_util.h"
 #include <gtest/gtest.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -152,4 +152,4 @@ TEST(StringUtilTest, SplitString) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/test_helpers.cc

@@ -26,7 +26,7 @@
 #include "string_util.h"
 #include "trust_store.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -483,4 +483,4 @@ void VerifyUserConstrainedPolicySet(
   }
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/test_helpers.h

@@ -19,7 +19,7 @@
 #include "trust_store.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 
@@ -162,6 +162,6 @@ void VerifyUserConstrainedPolicySet(
     const std::set<der::Input> &actual_user_constrained_policy_set,
     const std::string &errors_file_path);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TEST_HELPERS_H_

src/pki/trust_store.cc

@@ -8,7 +8,7 @@
 
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -174,4 +174,4 @@ void TrustStore::AsyncGetIssuersOf(const ParsedCertificate *cert,
   out_req->reset();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/trust_store.h

@@ -12,7 +12,7 @@
 #include "cert_issuer_source.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 enum class CertificateTrustType {
   // This certificate is explicitly blocked (distrusted).
@@ -139,6 +139,6 @@ class OPENSSL_EXPORT TrustStore : public CertIssuerSource {
                          std::unique_ptr<Request> *out_req) final;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TRUST_STORE_H_

src/pki/trust_store_collection.cc

@@ -6,7 +6,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TrustStoreCollection::TrustStoreCollection() = default;
 TrustStoreCollection::~TrustStoreCollection() = default;
@@ -44,4 +44,4 @@ CertificateTrust TrustStoreCollection::GetTrust(const ParsedCertificate *cert) {
   return result;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/trust_store_collection.h

@@ -9,7 +9,7 @@
 
 #include "trust_store.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // TrustStoreCollection is an implementation of TrustStore which combines the
 // results from multiple TrustStores.
@@ -38,6 +38,6 @@ class OPENSSL_EXPORT TrustStoreCollection : public TrustStore {
   std::vector<TrustStore *> stores_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TRUST_STORE_COLLECTION_H_

src/pki/trust_store_collection_unittest.cc

@@ -8,7 +8,7 @@
 #include "test_helpers.h"
 #include "trust_store_in_memory.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -185,4 +185,4 @@ TEST_F(TrustStoreCollectionTest, DistrustTakesPriority) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/trust_store_in_memory.cc

@@ -4,7 +4,7 @@
 
 #include "trust_store_in_memory.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TrustStoreInMemory::TrustStoreInMemory() = default;
 TrustStoreInMemory::~TrustStoreInMemory() = default;
@@ -98,4 +98,4 @@ const TrustStoreInMemory::Entry *TrustStoreInMemory::GetEntry(
   return nullptr;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/trust_store_in_memory.h

@@ -12,7 +12,7 @@
 
 #include "trust_store.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // A very simple implementation of a TrustStore, which contains a set of
 // certificates and their trustedness.
@@ -96,6 +96,6 @@ class OPENSSL_EXPORT TrustStoreInMemory : public TrustStore {
   const Entry *GetEntry(const ParsedCertificate *cert) const;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TRUST_STORE_IN_MEMORY_H_

src/pki/trust_store_in_memory_unittest.cc

@@ -17,7 +17,7 @@
 #include <gtest/gtest.h>
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 class TrustStoreInMemoryTest : public testing::Test {
@@ -109,4 +109,4 @@ TEST_F(TrustStoreInMemoryTest, DistrustBySPKIOverridesTrust) {
 }
 
 }  // namespace
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/verify.cc

@@ -41,7 +41,7 @@
 #include "trust_store_in_memory.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -351,4 +351,4 @@ std::optional<std::vector<std::vector<std::string>>> CertificateVerifyAllPaths(
   return CertificateVerifyInternal(opts, nullptr, nullptr, /*all_paths=*/true);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END

src/pki/verify_certificate_chain.cc

@@ -19,7 +19,7 @@
 #include "trust_store.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1677,4 +1677,4 @@ bool VerifyCertificateIsSelfSigned(const ParsedCertificate &cert,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END