Release Build (from refs/tags/v1.4.1/b875b84c446539b2bd6fdf66db459afe0f7f649b)
This is a security release. certstrap's code is unchanged since v1.4.0. Only the Go toolchain and dependencies changed.
Upgrade notes
- Release binaries are built with Go 1.27.3. The v1.4.0 binaries were built with Go 1.24.13, which no longer gets security fixes. Upgrading fixes standard library denial-of-service bugs that hostile input could trigger, such as unbounded recursion in
encoding/asn1(GO-2026-5972), which CSR parsing reaches. - Go 1.27.3 or later is required to build certstrap from source or to import its packages. Go 1.27.3 adds a
crypto/x509denylist of compromised intermediate certificates (GO-2026-6809). That matters for programs that callpkix.Certificate.VerifyHost. The certstrap CLI doesn't call it. - Dependencies: go.step.sm/crypto 0.91.0 and golang.org/x/crypto 0.58.0.
What's Changed
- Build with Go 1.27.3 and update dependencies by @mbyczkowski in #246
Full Changelog: v1.4.0...v1.4.1