Fix QUICHE OSS

This adds a dependency on anonymous_tokens. We've been using it for years in blind_sign_auth but that was compiled out of OSS.

PiperOrigin-RevId: 890628552

MODULE.bazel

diff --git a/MODULE.bazel b/MODULE.bazel
index f80e090..b101082 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -50,3 +50,10 @@
     strip_prefix = "gurl-94ff147fe0b96b4cca5d6d316b9af6210c0b8051",
     urls = ["https://github.com/google/gurl/archive/94ff147fe0b96b4cca5d6d316b9af6210c0b8051.tar.gz"],
 )
+
+http_archive(
+    name = "com_google_anonymous_tokens",
+    sha256 = "60fc9e1d7c9250c0b87d2d5aa1e78bbe34f6f839c8ae954a02adff2338967957",  # Last updated 2026-03-27
+    strip_prefix = "anonymous-tokens-e31089547b3d14a8a441bb58df086b171ebc915e",
+    urls = ["https://github.com/google/anonymous-tokens/archive/e31089547b3d14a8a441bb58df086b171ebc915e.tar.gz"],
+)

quiche/BUILD.bazel

diff --git a/quiche/BUILD.bazel b/quiche/BUILD.bazel
index 1792111..8dd7241 100644
--- a/quiche/BUILD.bazel
+++ b/quiche/BUILD.bazel
@@ -19,6 +19,8 @@
     "io_tests_srcs",
     "io_tool_support_hdrs",
     "io_tool_support_srcs",
+    "masque_private_tokens_hdrs",
+    "masque_private_tokens_srcs",
     "masque_support_hdrs",
     "masque_support_srcs",
     "moqt_hdrs",
@@ -375,6 +377,38 @@
 )
 
 cc_library(
+    name = "masque_private_tokens_lib",
+    srcs = masque_private_tokens_srcs,
+    hdrs = masque_private_tokens_hdrs,
+    deps = [
+        ":quiche_core",
+        "@boringssl//:crypto",
+        "@boringssl//:ssl",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings",
+        "@com_google_anonymous_tokens//anonymous_tokens/cpp/crypto:crypto_utils",
+        "@com_google_anonymous_tokens//anonymous_tokens/cpp/crypto:rsa_blinder",
+        "@com_google_anonymous_tokens//anonymous_tokens/cpp/privacy_pass:rsa_bssa_client",
+        "@com_google_anonymous_tokens//anonymous_tokens/cpp/privacy_pass:token_encodings",
+    ],
+)
+
+cc_binary(
+    name = "masque_private_tokens",
+    srcs = ["quic/masque/private_tokens_bin.cc"],
+    deps = [
+        ":masque_private_tokens_lib",
+        ":quiche_core",
+        ":quiche_tool_support",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_library(
     name = "masque_support",
     srcs = masque_support_srcs,
     hdrs = masque_support_hdrs,
@@ -671,6 +705,7 @@
     deps = [
         ":binary_http",
         ":io_tool_support",
+        ":masque_private_tokens_lib",
         ":masque_support",
         ":oblivious_http",
         ":quiche_core",

quiche/quic/masque/private_tokens.cc

diff --git a/quiche/quic/masque/private_tokens.cc b/quiche/quic/masque/private_tokens.cc
index bb9b046..8d67f09 100644
--- a/quiche/quic/masque/private_tokens.cc
+++ b/quiche/quic/masque/private_tokens.cc
@@ -26,7 +26,6 @@
 #include "openssl/rand.h"
 #include "openssl/rsa.h"
 #include "openssl/sha.h"
-#include "openssl/sha2.h"
 #include "quiche/common/quiche_status_utils.h"
 
 namespace quic {

quiche/quic/moqt/moqt_framer.cc

diff --git a/quiche/quic/moqt/moqt_framer.cc b/quiche/quic/moqt/moqt_framer.cc
index 740d30f..e8e2d2b 100644
--- a/quiche/quic/moqt/moqt_framer.cc
+++ b/quiche/quic/moqt/moqt_framer.cc
@@ -220,7 +220,8 @@
   return buffer;
 }
 
-WireUint8 WireDeliveryOrder(std::optional<MoqtDeliveryOrder> delivery_order) {
+[[maybe_unused]] WireUint8 WireDeliveryOrder(
+    std::optional<MoqtDeliveryOrder> delivery_order) {
   if (!delivery_order.has_value()) {
     return WireUint8(0x00);
   }