Skip to content

v0.45.2 (2026-10-29)

Latest
Latest

Choose a tag to compare

View all tags
@emmansun emmansun released this 29 Oct 03:45
v0.45.2
881a4d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Patch

This patch updates the smx509 baseline to Go 1.26.10 and incorporates the
upstream fix for CVE-2026-111943 / GO-2026-6809. Users relying on
smx509.Certificate.Verify for certificate-chain validation should upgrade,
especially when accepting public CA chains or using system trust stores.

Security Fix

  • Reject certificate chains containing the known distrusted Subject Public Key
    Info (SPKI) hashes identified by the upstream fix.
  • Apply the rejection in both the Go verifier and the Windows system verifier.
  • Enforce the rejection even when ExtKeyUsageAny is requested.

The issue concerns continued trust in specific compromised intermediate
certificates. It is not a break of SM2 or SM3, and does not by itself require
rotating SM2 keys or replacing otherwise unaffected certificates.

Deployments using an explicitly restricted private PKI whose accepted chains
do not contain the distrusted SPKIs are not affected by this specific issue.
Using an SM2 leaf certificate alone is not sufficient to establish that a
deployment is unaffected; the accepted trust chains must also be considered.
Standalone SM2 message-signature verification and certificate parsing are not
the affected certificate-chain verification operation.

Upgrade Guidance

  • Upgrade gmsm to the release containing this fix and rebuild applications.
    Updating the Go toolchain alone does not update the forked verification code
    in older gmsm releases.
  • Also use Go 1.26.10, Go 1.27.3, or a later supported security release to cover
    certificate verification performed by the Go standard library.
  • Keep operating-system and application-managed trust stores up to date. The
    SPKI denylist is a targeted safeguard, not general-purpose revocation checking.

Compatibility

  • No public API changes.
  • The minimum Go version remains Go 1.26.0.
  • Certificate chains containing a listed SPKI now fail verification. This is
    the intended security-related behavior change.

Maintenance

  • Refresh the committed standard-library baseline and declarative source patches.
  • Preserve existing SM2, post-quantum, and SM4 extensions.
  • Make repeated synchronization tolerate already-applied patches and keep test
    files and assets out of source-only baseline synchronization.

Validation

  • Full project test suite passed using Go 1.26.10, with OpenSSL available for
    interoperability tests.
  • Builds passed for Windows, Linux, and macOS on amd64 and arm64.
  • Regression coverage checks distrusted SPKIs at the leaf, intermediate, and
    root positions, including ExtKeyUsageAny, using a custom root pool.
  • All seven source and test patches regenerate without changes. All 25 source
    files reconstructed from a clean baseline and the source patches match the
    working implementation byte-for-byte.

References

Assets 2
Loading