[mbyczkowski]

Why

The v1.4.0 binaries were built with go1.24.13, because the release workflow builds with the Go version in go.mod. Go 1.24 no longer gets security fixes. govulncheck finds 5 standard library vulnerabilities in those binaries that certstrap code can reach. For example, encoding/asn1 has no recursion limit (GO-2026-5972) and is reached from CSR handling. crypto/x509 hostname parsing (GO-2026-5037) is reached from Certificate.VerifyHost. All five are denial of service on hostile input, such as a CSR passed to sign.

Go 1.27.3 also adds a crypto/x509 denylist that makes Certificate.Verify reject a set of compromised intermediate certificates from one CA (GO-2026-6809, CVE-2026-111943, golang/go#82345). Go calls it an urgent fix. The certstrap CLI never calls Verify, but pkix.Certificate.VerifyHost does, so programs that import the pkix package need it.

What

Move to Go 1.27.3 and update dependencies, for a v1.4.1 release.

How

• Raise go.mod to go 1.27.3, so source builds and importers get the denylist.
• Include Bump go.step.sm/crypto from 0.67.0 to 0.91.0 #242's dependency updates, which also cover Bump golang.org/x/crypto from 0.39.0 to 0.52.0 #243, and update the golang.org/x modules again. go.step.sm/crypto moves from 0.67.0 to 0.91.0 and golang.org/x/crypto from 0.39.0 to 0.58.0. Every module in go.mod is now at its latest version.
• Build releases with the newest Go 1.27 patch release (go-version: "1.27.x" with check-latest), not the go.mod minimum. Before this change, go-version-file would install whichever patch go.mod names.
• Upgrade golangci-lint from v1.64.8 to v2.14.0, since v1 can't lint a module that targets a newer Go than it was built with. A new .golangci.yml keeps v1's default checks, so the upgrade adds no findings. The (De|En)cryptPEMBlock exclusion for x509.(Encrypt|Decrypt)PEMBlock have been deprecated #124 moves from the workflow into that file.
• Build the Docker image with golang:1.27-alpine.

Risk

Building certstrap from source, or importing its packages, now needs Go 1.27.3. With the default GOTOOLCHAIN=auto, older Go versions download 1.27.3 automatically.

Testing

• go vet, unit tests and integration tests pass on Go 1.27.3. golangci-lint v2.14.0 reports 0 issues.
• govulncheck reports 0 vulnerabilities affecting certstrap, in both source mode and on a Go 1.27.3 build of this branch. The v1.4.0 binary had 5. The one remaining advisory, GO-2026-5932, is for x/crypto's openpgp package, which certstrap doesn't use.
• The release workflow runs on this PR because the PR changes it.

🤖 Generated with Claude Code