Release Version 1.4.0 · square/certstrap

Release Build (from refs/tags/v1.4.0/f392bdae4120f8a898644056546bfea33eeee783)

Upgrade notes

Go 1.24 or later is required to build certstrap from source.
New arm64 binaries: this release adds certstrap-darwin-arm64 and certstrap-linux-arm64, plus a SHA256SUMS file for all binaries.
CRL requirements: init and revoke now create CRLs with Go's x509.CreateRevocationList. It requires the CA certificate to have a subject key ID and, if the certificate lists key usages, the CRL signing usage. CAs created by certstrap already have both, so this only affects CA certificates added to a depot by another tool.
Existing CRLs: revoke still reads the v1 CRLs written by earlier releases. The CRLs it writes are v2, with a CRL number that goes up by one on each revoke.
--version now comes from Go build info. go install github.com/square/certstrap@v1.4.0 reports 1.4.0. Builds without git metadata, including the Docker image, report (devel).

Allow password-protected CAs to call revoke command by @isemaya-square in #165
Bump go.step.sm/crypto from 0.16.2 to 0.17.0 by @dependabot[bot] in #166
update cism to cryptographic-identity by @violetd12 in #187
Bump go.step.sm/crypto from 0.17.0 to 0.25.1 by @dependabot[bot] in #188
Bump github.com/urfave/cli from 1.22.9 to 1.22.12 by @dependabot[bot] in #183
Bump github.com/urfave/cli from 1.22.12 to 1.22.13 by @dependabot[bot] in #199
release for arm64 by @gflex in #194
[LSC] Update cryptid reference to idinfra-staff by @suzy-huang in #222
Pin github action versions following Github security best practices by @matthewhart-block in #227
Move to Go 1.19 by @jdtw in #167
Remove GODEBUG setting for X.509 SHA-1 from tests by @matthewhart-block in #229
Update Go to 1.24 by @mbyczkowski in #228
Fix certstrap CI after the Go 1.24 upgrade by @mbyczkowski in #241
Fix the release workflow by @mbyczkowski in #244
Read --version from Go build info by @mbyczkowski in #245

Full Changelog: v1.3.0...v1.4.0