| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| SHA256SUMS | 2026-10-23 | 444 Bytes | |
| certstrap-darwin-amd64 | 2026-10-23 | 10.1 MB | |
| certstrap-darwin-arm64 | 2026-10-23 | 9.5 MB | |
| certstrap-linux-amd64 | 2026-10-23 | 9.9 MB | |
| certstrap-linux-arm64 | 2026-10-23 | 9.3 MB | |
| certstrap-windows-amd64 | 2026-10-23 | 10.1 MB | |
| README.md | 2026-10-23 | 1.1 kB | |
| Version 1.4.1 source code.tar.gz | 2026-10-23 | 57.8 kB | |
| Version 1.4.1 source code.zip | 2026-10-23 | 87.9 kB | |
| Totals: 9 Items | 49.0 MB | 0 | |
Release Build (from refs/tags/v1.4.1/b875b84c446539b2bd6fdf66db459afe0f7f649b)
This is a security release. certstrap's code is unchanged since v1.4.0. Only the Go toolchain and dependencies changed.
Upgrade notes
- Release binaries are built with Go 1.27.3. The v1.4.0 binaries were built with Go 1.24.13, which no longer gets security fixes. Upgrading fixes standard library denial-of-service bugs that hostile input could trigger, such as unbounded recursion in
encoding/asn1(GO-2026-5972), which CSR parsing reaches. - Go 1.27.3 or later is required to build certstrap from source or to import its packages. Go 1.27.3 adds a
crypto/x509denylist of compromised intermediate certificates (GO-2026-6809). That matters for programs that callpkix.Certificate.VerifyHost. The certstrap CLI doesn't call it. - Dependencies: go.step.sm/crypto 0.91.0 and golang.org/x/crypto 0.58.0.
What's Changed
- Build with Go 1.27.3 and update dependencies by @mbyczkowski in https://github.com/square/certstrap/pull/246
Full Changelog: https://github.com/square/certstrap/compare/v1.4.0...v1.4.1
