certstrap Files

Release Build (from refs/tags/v1.4.0/f392bdae4120f8a898644056546bfea33eeee783)

Upgrade notes

• Go 1.24 or later is required to build certstrap from source.
• New arm64 binaries: this release adds certstrap-darwin-arm64 and certstrap-linux-arm64, plus a SHA256SUMS file for all binaries.
• CRL requirements: init and revoke now create CRLs with Go's x509.CreateRevocationList. It requires the CA certificate to have a subject key ID and, if the certificate lists key usages, the CRL signing usage. CAs created by certstrap already have both, so this only affects CA certificates added to a depot by another tool.
• Existing CRLs: revoke still reads the v1 CRLs written by earlier releases. The CRLs it writes are v2, with a CRL number that goes up by one on each revoke.
• --version now comes from Go build info. go install github.com/square/certstrap@v1.4.0 reports 1.4.0. Builds without git metadata, including the Docker image, report (devel).

What's Changed

• Allow password-protected CAs to call revoke command by @isemaya-square in https://github.com/square/certstrap/pull/165
• Bump go.step.sm/crypto from 0.16.2 to 0.17.0 by @dependabot[bot] in https://github.com/square/certstrap/pull/166
• update cism to cryptographic-identity by @violetd12 in https://github.com/square/certstrap/pull/187
• Bump go.step.sm/crypto from 0.17.0 to 0.25.1 by @dependabot[bot] in https://github.com/square/certstrap/pull/188
• Bump github.com/urfave/cli from 1.22.9 to 1.22.12 by @dependabot[bot] in https://github.com/square/certstrap/pull/183
• Bump github.com/urfave/cli from 1.22.12 to 1.22.13 by @dependabot[bot] in https://github.com/square/certstrap/pull/199
• release for arm64 by @gflex in https://github.com/square/certstrap/pull/194
• [LSC] Update cryptid reference to idinfra-staff by @suzy-huang in https://github.com/square/certstrap/pull/222
• Pin github action versions following Github security best practices by @matthewhart-block in https://github.com/square/certstrap/pull/227
• Move to Go 1.19 by @jdtw in https://github.com/square/certstrap/pull/167
• Remove GODEBUG setting for X.509 SHA-1 from tests by @matthewhart-block in https://github.com/square/certstrap/pull/229
• Update Go to 1.24 by @mbyczkowski in https://github.com/square/certstrap/pull/228
• Fix certstrap CI after the Go 1.24 upgrade by @mbyczkowski in https://github.com/square/certstrap/pull/241
• Fix the release workflow by @mbyczkowski in https://github.com/square/certstrap/pull/244
• Read --version from Go build info by @mbyczkowski in https://github.com/square/certstrap/pull/245

New Contributors

• @violetd12 made their first contribution in https://github.com/square/certstrap/pull/187
• @gflex made their first contribution in https://github.com/square/certstrap/pull/194
• @suzy-huang made their first contribution in https://github.com/square/certstrap/pull/222
• @matthewhart-block made their first contribution in https://github.com/square/certstrap/pull/227

Full Changelog: https://github.com/square/certstrap/compare/v1.3.0...v1.4.0