v/0.104.0-alpha.8

Distrust a small set of intermediate certificate subject public keys due to specific security concerns around their operation.

What's Changed

• tests: add x509-limbo coverage by @cpu in #467
• Avoid wrapping in malformed OIDs by @djc in #478
• der: use get() instead of check + index by @djc in #477
• Use eq_ignore_ascii_case() instead of providing our own by @djc in #476
• Simplify IP address matching by @djc in #475
• fuzz: add basic parser fuzz coverage by @cpu in #479
• tests: avoid vendored limbo.json by @cpu in #480
• Limbo tweaks by @djc in #481
• Bump rcgen version to match actual requirements by @djc in #483
• der: Reject non-canonical encoding of bit strings. by @briansmith in #484
• Expose builder-like interface for path verification by @djc in #486
• doc: change tools.ietf.org references to official rfc-editor.org, use https by @mcr in #495
• Correct section number for id-ce-issuingDistributionPoint by @ctz in #498
• Test borrowed CRL hashing by @xyzzyz in #501
• Require CRL number extension by @xyzzyz in #500
• Enforce module import formatting by @xyzzyz in #503
• Further commentary fixes by @ctz in #499
• Adopt rustls nightly formatting arrangement by @ctz in #504
• Fix CRL selection by cRLNumber and scope by @xyzzyz in #491
• build(deps): bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in #506
• ci: sync cargo-check-external-types nightly by @cpu in #507
• update x509-limbo to latest by @cpu in #508
• Verify usage of keyCertSign bit in keyUsage extensions by @djc in #510
• Require end entities to have digitalSignatures key usage by @djc in #511
• Force intermediates and revocation to be specified by @djc in #509
• Tighten handling of trailing input by @ctz in #512
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #513
• crl: fix clippy::question_mark finding by @cpu in #516
• build(deps): bump the crates-io group with 3 updates by @dependabot[bot] in #518
• update x509-limbo pin for ML-DSA test coverage by @cpu in #517
• Bump semver compatible deps, restore Python CI by @cpu in #520
• Small CI tidying by @cpu in #521
• build(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #522
• SctParser: terminate for callers which ignore errors by @ctz in #524
• subject_name: escape names in GeneralName's Debug output by @satokan in #527
• build(deps): bump rcgen from 0.14.8 to 0.14.9 in the crates-io group by @dependabot[bot] in #529
• remove copyright header comments by @cpu in #534
• update x509-limbo to latest, fix empty name constraint seq handling by @cpu in #535
• crl: use Input length helpers by @cpu in #536
• build(deps): bump rcgen from 0.14.9 to 0.14.10 in the crates-io group by @dependabot[bot] in #537
• ci: fix no-std toolchain target expansion by @cpu in #541
• build(deps): bump serde_json from 1.0.151 to 1.0.152 in the crates-io group by @dependabot[bot] in #542
• 0.104.0-alpha.8: reject cert paths containing distrusted SPKIs by @cpu in #545

New Contributors

• @briansmith made their first contribution in #484
• @mcr made their first contribution in #495
• @xyzzyz made their first contribution in #501
• @satokan made their first contribution in #527

Full Changelog: v/0.104.0-alpha.7...v/0.104.0-alpha.8