v/0.102.3

• New KeyUsage::required_if_present() fn for requiring a certificate to support the specified OID, if the certificate has EKUs.
• Updates aws-lc-rs to 1.7.0
• MSRV increased from 1.61 to 1.63

What's Changed

• build(deps): bump codecov/codecov-action from 3 to 4 by @dependabot in #226
• Allow "required if present" EKUs by @jasperpatterson in #229
• Synchronise codecov action settings with rustls by @ctz in #230
• ci: sync nightly for check-external-types by @cpu in #231
• build(deps): bump cryptography from 41.0.6 to 42.0.4 by @dependabot in #233
• Fix nightly compilation by @ctz in #234
• Fix windows build by @ctz in #235
• build(deps): bump base64 from 0.21.7 to 0.22.0 by @dependabot in #237
• build(deps): bump serde_json from 1.0.114 to 1.0.115 by @dependabot in #238
• Update semver-compatible dependencies by @djc in #241
• deps: rcgen 0.12 -> 0.13 by @cpu in #239
• Simplify test chain building by @djc in #244
• build(deps): bump serde_json from 1.0.115 to 1.0.116 by @dependabot in #245
• build(deps): bump serde from 1.0.197 to 1.0.198 by @dependabot in #247
• Update Dependabot config to match rustls by @djc in #249
• v0.102.3, bump aws-lc-rs from 1.6.4 to 1.7.0, MSRV 1.63 by @cpu in #248

New Contributors

• @jasperpatterson made their first contribution in #229

Full Changelog: v/0.102.2...v/0.102.3

0.102.2

What's Changed

• small nightly clippy fixes by @cpu in #222
• Cargo: avoid unused aws-lc-rs default features by @cpu in #224
• aws_lc_rs_algs: Expose FIPS status by @ctz in #225

Full Changelog: v/0.102.1...v/0.102.2

0.102.1

Headlines

• Added webpki::aws_lc_rs::ECDSA_P521_SHA512: support for P521-SHA512 signature verification.

What's Changed

• build(deps): bump cryptography from 41.0.4 to 41.0.6 by @dependabot in #215
• Introduce and test ECDSA_P521_SHA512 for aws-lc-rs by @ctz in #216
• build(deps): bump actions/setup-python from 4 to 5 by @dependabot in #218
• cert: fix clippy get_first finding by @cpu in #220
• build(deps): update rcgen requirement from 0.11.3 to 0.12.0 by @dependabot in #219

Full Changelog: v/0.102.0...v/0.102.1

0.102.0

Headlines

• More powerful certificate revocation list (CRL) support. There is now an API for explicitly configuring whether CRLs are mandatory or optional, and which parts of the certificate chain they apply to.
• Extensible and observable path building. This crate now returns an example of a found certificate path, and optionally allows callers to reject valid paths to continue the search.
• Improving API stability. This crate now uses types from rustls-pki-types; we expect this to reduce the number of breaking changes in rustls ecosystem.
• Pluggable crypto providers. This crate can now depend on signature verification algorithms provided externally. ring is now an optional (but default) dependency, and aws-lc-rs is a new optional dependency.

What's Changed

• cert: retain CRL distribution points extension. by @cpu in #127
• Tweak style in distribution point handling by @djc in #137
• crl: retain issuing distribution point extension by @cpu in #128
• Implement FromDer trait and DerIterator type by @djc in #139
• Make ring optional by @ctz in #134
• Name iterator by @djc in #140
• Impl FromDer for more types by @djc in #141
• fix no-std support by @japaric in #145
• Refactor DER parsing by @djc in #142
• revocation: more sophisticated revocation checking. by @cpu in #138
• build(deps): bump cryptography from 41.0.2 to 41.0.3 by @dependabot in #146
• Use doc_auto_cfg and remove manual doc(cfg()) gates by @ctz in #150
• bettertls: test both pathbuilding and nameconstraints. by @cpu in #151
• verify_cert: enforce maximum number of signatures. by @cpu in #152
• Fix build & clippy lints by @ctz in #156
• SECURITY.md: use github vuln reporting tool by @ctz in #155
• Enable warnings for cargo doc comments on private items by @cpu in #157
• Switch to using the pki-types crate by @djc in #147
• Bump version to alpha.1 with pki-types by @djc in #161
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #162
• Further limits on expensive path building by @ctz in #163
• Budget tweaks by @djc in #164
• Use signature verification trait from pki-types by @ctz in #166
• verify_cert: bound name constraint comparisons. by @cpu in #165
• Remove subject common name parsing by @hawkw in #169
• verify_cert: correct handling of fatal errors. by @cpu in #168
• subject_name: fix stale unused_imports allow. by @cpu in #171
• Extract PathNode from Cert by @djc in #173
• Use pki_types::UnixTime instead of local Time type by @djc in #175
• tests: local test speed optimizations, add cargo hack feature powerset by @cpu in #176
• docs: add CONTRIBUTING.md, ref'ing Rustls CONTRIBUTING by @cpu in #177
• Note that self-signed certificates are not supported. by @bdaehlie in #180
• properly test build chain call budget by @cpu in #179
• Use stable for coverage measurement by @ctz in #181
• Optionally support aws-lc-rs by @ctz in #158
• rework dns_names helper, remove alloc req. by @cpu in #178
• Let EndEntityCert deref to Cert by @djc in #184
• Refactor name verification flow by @djc in #188
• Cargo: remove rcgen git patch by @cpu in #189
• crl: rm Budget from verify_signature fn by @cpu in #190
• NFC: Correct name of mozilla::pkix in comment. by @cpu in #192
• Cargo: restore rcgen w/ no-default-features by @cpu in #195
• Upgrade to untrusted 0.9 and ring 0.17 by @djc in #193
• Prepare 0.102.0-alpha.4 by @ctz in #194
• build(deps): bump cryptography from 41.0.3 to 41.0.4 by @dependabot in #196
• Expose built path in public API by @djc in #174
• verify_cert: add test for rejecting candidate path by @cpu in #197
• Deny warnings from clippy by @djc in #198
• Use cargo-check-external-types to control type leakage in public API by @cpu in #202
• trust_anchor: fix stale note about EndEntityOrCA by @cpu in #204
• Improve CRL ergonomics, replace trait with enum by @cpu in #203
• trust_anchor: clarify and rename extract_trust_anchor by @cpu in #201
• Remove unused git exception from deny config by @djc in #208
• Migrate to pki-types ServerName by @djc in #207
• verify_cert: re-export VerifiedPath by @BiagioFesta in #210
• derive Debug for RingAlgorithm, AwsLcRsAlgorithm by @cpu in #212

New Contributors

• @japaric made their first contribution in #145
• @hawkw made their first contribution in #169
• @bdaehlie made their first contribution in #180
• @BiagioFesta made their first contribution in #210

Full Changelog: v/0.101.7...v/0.102.0

v/0.102.0-alpha.8

What's Changed

• trust_anchor: clarify and rename extract_trust_anchor by @cpu in #201
• Remove unused git exception from deny config by @djc in #208
• Migrate to pki-types ServerName by @djc in #207
• verify_cert: re-export VerifiedPath by @BiagioFesta in #210
• derive Debug for RingAlgorithm, AwsLcRsAlgorithm by @cpu in #212

New Contributors

• @BiagioFesta made their first contribution in #210

Full Changelog: v/0.102.0-alpha.6...v/0.102.0-alpha.8

v/0.102.0-alpha.6

What's Changed

• build(deps): bump cryptography from 41.0.3 to 41.0.4 by @dependabot in #196
• Expose built path in public API by @djc in #174
• verify_cert: add test for rejecting candidate path by @cpu in #197
• Deny warnings from clippy by @djc in #198
• Use cargo-check-external-types to control type leakage in public API by @cpu in #202
• trust_anchor: fix stale note about EndEntityOrCA by @cpu in #204
• Improve CRL ergonomics, replace trait with enum by @cpu in #203

Full Changelog: v/0.102.0-alpha.4...v/0.102.0-alpha.6

0.101.7

• Upgrades *ring* to 0.17, and untrusted to 0.9. Note: since untrusted appears in the Error API this may be a breaking change for applications using two untrusted versions.

What's Changed

• Simplify tests for DER errors by @djc in #193
• Upgrade to ring 0.17, untrusted 0.9 by @djc in #193
• Bump MSRV to 1.61 by @djc in #193
• Upgrade to rcgen 0.11.3 by @cpu in #189, #195
• v0.101.7 preparation by @cpu in #199

Full Changelog: v/0.101.6...v/0.101.7

0.102.0-alpha.4

What's Changed

• cert: retain CRL distribution points extension. by @cpu in #127
• Tweak style in distribution point handling by @djc in #137
• crl: retain issuing distribution point extension by @cpu in #128
• Implement FromDer trait and DerIterator type by @djc in #139
• Make ring optional by @ctz in #134
• Name iterator by @djc in #140
• Impl FromDer for more types by @djc in #141
• fix no-std support by @japaric in #145
• Refactor DER parsing by @djc in #142
• revocation: more sophisticated revocation checking. by @cpu in #138
• build(deps): bump cryptography from 41.0.2 to 41.0.3 by @dependabot in #146
• Use doc_auto_cfg and remove manual doc(cfg()) gates by @ctz in #150
• bettertls: test both pathbuilding and nameconstraints. by @cpu in #151
• verify_cert: enforce maximum number of signatures. by @cpu in #152
• Fix build & clippy lints by @ctz in #156
• SECURITY.md: use github vuln reporting tool by @ctz in #155
• Enable warnings for cargo doc comments on private items by @cpu in #157
• Switch to using the pki-types crate by @djc in #147
• Bump version to alpha.1 with pki-types by @djc in #161
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #162
• Further limits on expensive path building by @ctz in #163
• Budget tweaks by @djc in #164
• Use signature verification trait from pki-types by @ctz in #166
• verify_cert: bound name constraint comparisons. by @cpu in #165
• Remove subject common name parsing by @hawkw in #169
• verify_cert: correct handling of fatal errors. by @cpu in #168
• subject_name: fix stale unused_imports allow. by @cpu in #171
• Extract PathNode from Cert by @djc in #173
• Use pki_types::UnixTime instead of local Time type by @djc in #175
• tests: local test speed optimizations, add cargo hack feature powerset by @cpu in #176
• docs: add CONTRIBUTING.md, ref'ing Rustls CONTRIBUTING by @cpu in #177
• Note that self-signed certificates are not supported. by @bdaehlie in #180
• properly test build chain call budget by @cpu in #179
• Use stable for coverage measurement by @ctz in #181
• Optionally support aws-lc-rs by @ctz in #158
• rework dns_names helper, remove alloc req. by @cpu in #178
• Let EndEntityCert deref to Cert by @djc in #184
• Refactor name verification flow by @djc in #188
• Cargo: remove rcgen git patch by @cpu in #189
• crl: rm Budget from verify_signature fn by @cpu in #190
• NFC: Correct name of mozilla::pkix in comment. by @cpu in #192
• Cargo: restore rcgen w/ no-default-features by @cpu in #195
• Upgrade to untrusted 0.9 and ring 0.17 by @djc in #193
• Prepare 0.102.0-alpha.4 by @ctz in #194

New Contributors

• @japaric made their first contribution in #145
• @hawkw made their first contribution in #169
• @bdaehlie made their first contribution in #180

Full Changelog: v/0.101.6...v/0.102.0-alpha.4

0.101.6

• The CertificateRevocationList trait's verify_signature Budget argument was removed. This was a semver incompatible change mistakenly introduced in v0.101.5.

What's Changed

• crl: rm Budget from verify_signature fn by @cpu in #187

Full Changelog: v/0.101.5...v/0.101.6

0.101.5

• Path building complexity is now limited to a maximum budget of path finding operations, avoiding exponential processing time when encountering certificate chains containing many certificates with the same subject/issuer distinguished name but different subject public key information.
• Name constraints evaluation is now limited to a maximum number of comparison operations, avoiding exponential processing time when encountering certificate chains containing many name constraints and subject alternate names.
• Subject common names are no longer parsed for name iteration, or applying name constraints. Webpki only uses Subject Alternate Names when validating certificates, and the common name handling was buggy, producing Error::BadDer when iterating certificates with printable string subject common names, or omitted common names encoded as an empty sequence.

What's Changed

The following PRs were backported to the rel-0.101 branch in #170:

• Further limits on expensive path building (#163)
• Budget tweaks (#164)
• Bound name constraint comparisons (#165)
• Remove subject common name parsing (#169, thanks to @hawkw)
• Correct handling of fatal errors (#168)

Thanks to all who have contributed, on behalf of the rustls team (@ctz, @cpu and @djc)!