Bump BoringSSL submodule to 4a3cda40b (API version 40)

boring-sys/build/config.rs

@@ -107,7 +107,8 @@ impl Config {
             );
         }
 
-        let features_with_patches_enabled = self.features.rpk || self.features.underscore_wildcards;
+        // RPK support is now native to BoringSSL, no patch needed.
+        let features_with_patches_enabled = self.features.underscore_wildcards;
 
         let patches_required = features_with_patches_enabled && !self.env.assume_patched;
 

boring-sys/build/main.rs

@@ -443,13 +443,11 @@ fn ensure_patches_applied(config: &Config) -> io::Result<()> {
             native BoringSSL is expected to have the patches included"
         );
         return Ok(());
-    } else if config.env.source_path.is_some()
-        && (config.features.rpk || config.features.underscore_wildcards)
-    {
+    } else if config.env.source_path.is_some() && config.features.underscore_wildcards {
         panic!(
             "BORING_BSSL_ASSUME_PATCHED must be set when setting
                BORING_BSSL_SOURCE_PATH and using any of the following
-               features: rpk, underscore-wildcards"
+               features: underscore-wildcards"
         );
     }
 
@@ -467,10 +465,7 @@ fn ensure_patches_applied(config: &Config) -> io::Result<()> {
     println!("cargo:warning=applying post quantum crypto patch to boringssl");
     apply_patch(config, "boring-pq.patch")?;
 
-    if config.features.rpk {
-        println!("cargo:warning=applying RPK patch to boringssl");
-        apply_patch(config, "rpk.patch")?;
-    }
+    // RPK support is now native to BoringSSL as of 4a3cda40b, no patch needed.
 
     if config.features.underscore_wildcards {
         println!("cargo:warning=applying underscore wildcards patch to boringssl");