`github.com/go-ldap/ldap/v3` now supports the two features that we
previously added to a local fork: extracting the TLS connection
state, and defining a connection timeout. This commit deletes the
fork and uses the upstream dependency.
This commit also adjusts the `certigo connect` TLS configuration to
support every cipher suite supported by `crypto/tls`, including
insecure ones. This improves the ability to extract certificates
from servers with poor cipher suite support. This limitation was
uncovered while testing LDAP connectivity.
This commit upgrades the language version to Go 1.24.4 and upgrades
the Sprig templating dependency from v2 to v3 in order to resolve
an indirect dependency issue. The major upgrade of Sprig changes
the behavior of some functions, but not in a significant way.
Go 1.23 introduced a change that rejects X.509 certificates with
negative serial numbers, due to Go's focus on the Web PKI
(see golang/go#71606). We continue to support negative serials by
setting a go:debug option for the main certigo binary, but other
users of certigo packages will need to set their own GODEBUG
settings appropriately to support this feature. If Go eventually
drops support, then we will, too.
This commit adds an explicit `golangci-lint` configuration that
simply matches the default linters previously in use, and then
fixes all current linter findings.
Aside from tweaking error message strings, this commit introduces
one externally visible behavior change: PEM data generated from
PKCS#12 files now correctly identifies private key blocks as
`RSA PRIVATE KEY` or `EC PRIVATE KEY`, whereas previously it
generated invalid `PRIVATE KEY` blocks with non-PKCS#8 data.
This commit lays the groundwork for more aggressive linting in the
future, and identifies some additional issues via TODOs.
Nik Unger