`github.com/zmap/zcrypto` currently does not compile on Windows:
see zmap/zcrypto#422. This commit downgrades the dependency to the
newest working version, from August 2024.
This commit adds a new workflow that builds `certigo` for all
target platforms on push, but does not create a new release. This
should help to identify any newly introduced compilation issues.
The configuration for the build is identical to the release
workflow.
This commit adds tests for the `jceks` package against the
installed JDK's `keytool` CLI. The tests ensure that JCEKS files
created by `keytool` can be read by the package, and vice versa.
These tests are disabled by default and are enabled with the
`-jceks.keytool-tests=true` flag. This commit configures GitHub
Actions to test the package against a wide variety of JDKs.
This commit also restricts GitHub Actions permissions.
This commit adds a JCEKS encoder to the `jceks` package.
Previously, the package was only capable of reading JCEKS files.
Internally, this commmit effectively rewrites the package.
These changes are backward compatible with the previous package API
and thus do not require a new major version. However, there are
several behavioral changes that have the potential to break
existing code that relied on edge cases:
- The package now returns an error when attempting to parse a JCEKS
file that contains an invalid X.509 certificate (either as a
trusted certificate entry, or as part of the chain for a private
key entry). Previously, the package silently ignored these
certificates. JCEKS files containing invalid certificates are
invalid, so affected files should be repaired.
- The package now returns an error by default when parsing a JCEKS
file containing a certificate or private key larger than 20MiB.
This limit guards against trivial memory exhaustion denial of
service attacks from malicious files, but the default is very
generous. Callers that need to parse larger certificates or
private keys can override the defaults using the new
`KeyStore.ParseWithOptions` method with appropriate options.
The internal changes to the package introduced by this commit are
substantial. Some of the highlights include:
- Fixed a bug with modified UTF-8 parsing.
- `testdata` is now generated by `go generate`, rather than
shelling out to `openssl` and `keytool` at unit test time.
- PKCS#5 padding is now removed when parsing.
- Tests are now far more comprehensive, including fuzz tests.
- General code cleanup and linter fixes.
This commit updates zlint to the latest version. The new version's
`e_key_usage_and_extended_key_usage_inconsistent` linter contains a
bug, so this commit disables it. The new version also correctly
identifies an error with some of the test certificates, so the
commit adds the error to the expected output (rather than
regenerating the certificates with modern policies).
This commit modifies the psql fork to accept a `*tls.Config` when
dumping TLS info. This allows us to pass the same broad
cipher suite configuration that we use for other connection types,
which preserves compatibility with older Go defaults. It also has
the side effect of hooking up the client certificate request info
callback, which means that Certigo now reports details about the
expected client certificate for Postgres connections.
In the future, we should eliminate our need for this fork by
switching to the `pgx` package and extracting the certificates via
new hooks in the `*tls.Config` struct, rather than patching this
outdated fork.
`github.com/go-ldap/ldap/v3` now supports the two features that we
previously added to a local fork: extracting the TLS connection
state, and defining a connection timeout. This commit deletes the
fork and uses the upstream dependency.
This commit also adjusts the `certigo connect` TLS configuration to
support every cipher suite supported by `crypto/tls`, including
insecure ones. This improves the ability to extract certificates
from servers with poor cipher suite support. This limitation was
uncovered while testing LDAP connectivity.
This commit upgrades the language version to Go 1.24.4 and upgrades
the Sprig templating dependency from v2 to v3 in order to resolve
an indirect dependency issue. The major upgrade of Sprig changes
the behavior of some functions, but not in a significant way.
Go 1.23 introduced a change that rejects X.509 certificates with
negative serial numbers, due to Go's focus on the Web PKI
(see golang/go#71606). We continue to support negative serials by
setting a go:debug option for the main certigo binary, but other
users of certigo packages will need to set their own GODEBUG
settings appropriately to support this feature. If Go eventually
drops support, then we will, too.
This commit adds an explicit `golangci-lint` configuration that
simply matches the default linters previously in use, and then
fixes all current linter findings.
Aside from tweaking error message strings, this commit introduces
one externally visible behavior change: PEM data generated from
PKCS#12 files now correctly identifies private key blocks as
`RSA PRIVATE KEY` or `EC PRIVATE KEY`, whereas previously it
generated invalid `PRIVATE KEY` blocks with non-PKCS#8 data.
This commit lays the groundwork for more aggressive linting in the
future, and identifies some additional issues via TODOs.
Mat Byczkowski