Release Build (from refs/tags/v1.18.2/21cfe18d4f83ce169318c6cf2ffaf79a89c5a029)
Highlights
- The binaries are built with Go 1.27.3 (v1.18.1 used Go 1.27.1). That fixes 9 Go standard library vulnerabilities that certigo code reaches. The most important is GO-2026-6809:
crypto/x509now rejects chains through the compromised eMudhra intermediate CAs, whichcertigo verifyandcertigo connectcould otherwise report as valid (#389). - SCTs show their log operator and URL again (#388). The CT log list now includes static-ct-api ("tiled") logs and the 2026–2027 logs that current certificates use, and it keeps expired logs, so older certificates still show theirs. v1.18.1 couldn't name the log for about half the SCTs on popular sites, including every SCT on certificates that expire in 2027.
certigo --completion-script-fishprints a fish completion script (#381).- Dependency updates: certificate-transparency-go 1.4.0, golang.org/x/crypto 0.58.0, go-pkcs12 0.7.4, go-ldap 3.4.15 and go-colorable 0.1.16.
What's Changed
- Bump golang.org/x/crypto from 0.55.0 to 0.57.0 by @dependabot[bot] in #379
- Upgrade kingpin for fish shell completions by @mbyczkowski in #381
- Pin the Go version for release builds by @mbyczkowski in #380
- Upgrade golangci-lint to v2.15.0 for Go 1.27.2+ by @mbyczkowski in #387
- Bump github.com/google/certificate-transparency-go from 1.3.3 to 1.4.0 by @dependabot[bot] in #386
- Bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in #385
- Bump software.sslmate.com/src/go-pkcs12 from 0.7.3 to 0.7.4 by @dependabot[bot] in #384
- Bump github.com/go-ldap/ldap/v3 from 3.4.14 to 3.4.15 by @dependabot[bot] in #383
- Bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 by @dependabot[bot] in #382
- Use one Go version, 1.27.3, for CI and releases by @mbyczkowski in #389
- Fix the CT log list generator and regenerate known logs by @mbyczkowski in #388
Full Changelog: v1.18.1...v1.18.2