v3.4.0-rc1

ZLint v3.4.0-rc1

The ZMap team is happy to share ZLint v3.4.0-rc1.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Features:

Individual lints may now be (optionally) configurable!

For Lint Authors

For lint authors, please see CONTRIBUTING.md for more details on how to write a lint that may receive optional configurations.

For users

For users of the CLI tool, configuring a particular lint is as simple as providing a valid toml file to ZLint.

zlint -config configFile.toml mycert.pem

ZLint also provides a facility for getting a print out of a valid, all default, configuration file such that users do not have to hunt through documentation to discover what lints are configurable and what their fields are.

For example...

zlint -exampleConfig

...currently prints to the terminal....

[AppleRootStorePolicyConfig]

[CABFBaselineRequirementsConfig]

[CABFEVGuidelinesConfig]

[CommunityConfig]

[MozillaRootStorePolicyConfig]

[RFC5280Config]

[RFC5480Config]

[RFC5891Config]

[e_rsa_fermat_factorization]
Rounds = 100

Note that there is already a lint that is configurable - e_rsa_fermat_factorization. This lint checks an RSA keypair for susceptibility to the Fermat factorization attack. The more rounds used, the more likely the lint is to successfully factor a key pair. However, increasing the number of rounds dramatically increases the amount of time taken to lint a single certificate. As such, the default is set to 100 as per CABF requirements and users are free to set this value to something lower (if they wish to lint a large number of certificates and want the batch job to run faster) or to something much higher (if they suspect that a key pair is susceptible, but not trivially so).

New Lints:

• e_key_usage_incorrect_length checks for KeyUsages that are outside the range of possible values.
• e_incorrect_ku_encoding check for KeyUsages that are not properly encoded ASN.1 bitstrings.
• e_rsa_fermat_factorization checks for key pairs that are susceptible to Fermat factorization.
• e_superfluous_ku_encoding checks for KeyUsages that have unnecessary trailing zero-bytes.
• e_ecdsa_allowed_ku key usage values keyEncipherment or dataEncipherment MUST NOT be present in certificates with ECDSA public keys
• e_rsa_allowed_ku_ca key usage values digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, and cRLSign may only be present in a CA certificate with an RSA key
• e_rsa_allowed_ku_ee key usage values digitalSignature, nonRepudiation, keyEncipherment, and dataEncipherment may only be present in an end entity certificate with an RSA key
• e_rsa_allowed_ku_no_encipherment_ca if Key usage value keyCertSign or cRLSign is present in a CA certificate both keyEncipherment and dataEncipherment SHOULD NOT be present"
• e_subject_contains_organizational_unit_name_and_no_organization_name if a subject organization name is absent then an organizational unit name MUST NOT be included in subject
• e_organizational_unit_name_prohibited organizationalUnitName is prohibited if...the certificate was issued on or after September 1, 2022

Bug Fixes:

• Corrected e_organizational_unit_name_prohibited to not lint CA certificates.
• Corrected a CABF citation in e_algorithm_identifier_improper_encoding
• Corrected an issue e_ext_tor_service_descriptor_hash_invalid wherein an OnionV3 certificate may be considered an OnionV2 certificate if a non-onion DNS entry were present in the certificate.

Changelog

• 137e46e Lint to check for invalid KU lengths (#686)
• 1209017 Prevent OU lint from applying to CA certificates. Add unit test to confirm change of behaviour (#691)
• 44e12c1 Add lint to check for incorrect 'unused' bit encoding in KeyUsages (#684)
• 3f5e40d Lint for RSA close prime Fermat factorization susceptibility (#674)
• e5ee614 Support for Configurable Lints (#648)
• ed9a20f Added lint to check for superfluous zero byte on KU (#682)
• d8b86f7 Lints for allowable key usages as per RFC 8813 Section 3 and RFC 3279 Section 2.3.1 (#678)
• c7955ed Sunset subject:organizationalUnitName (Section 7.1.4.2.2.i, CAB-Forum BR) (#643)
• b7abf25 Add new lint to block organisational unit names as of 1st September 2022 (#675)
• c32f6d3 Fix SPKI Encoding Lint's RSA BR Section (#679)
• ed6287a Zlint incorrectly requires TorServiceDescriptors if V3 onion and DNS name (#677)

Full Changelog: v3.3.1...v3.4.0-rc1

ZLint v3.3.1

ZLint v3.3.1

The ZMap team is happy to share ZLint v3.3.1.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• e_ev_not_wildcard asserts that wildcard domains are not allowable for EV certificates (except .onion addresses).
• e_dnsname_contains_prohibited_reserved_label asserts that every label within a FQDN must be either a P-Label or a Non-Reserved LDH Label.
• e_ev_san_ip_address_present asserts that Subject Alternative Name MUST contain only dnsName types.
• e_algorithm_identifier_improper_encoding asserts CABF BR 7.1.3.1 regarding requiring a specific byte sequence within a Subject Public Key Info field.
• e_underscore_not_permissible_in_dnsname asserts that underscore are not permissible after the brief permissibility period described in CABF BR 1.6.2.
• e_no_underscores_before_1_6_2 asserts that underscore are not permissible before the brief permissibility period described in CABF BR 1.6.2.

Bug Fixes:

• Corrected an issue in lint_idn_dnsname_malformed_unicode and lint_idn_dnsname_must_be_nfc wherein the IDNA ACE prefixes were incorrectly considered to be case-sensitive.
• A Tor Hash Descriptor is no longer required on certificates that encode Onion V3 addresses.

Misc:

• Numerous TLD updates.
• The CABF OID for EV (2.23.140.1.1) was added as a known EV OID.
• Some clearer datetime logic for more natural daterange checking.
• The ZLint project has been updated to use the Go 1.18 toolchain.
• zcrypto was updated to point towards commit @599ec18ecbac.
• Various quality of life changes to the ZLint developer experience.

Changelog

74f4541 Update to Go 1.18 and update GolangCI Linter (#672)
a34c016 QoL changes to genTestCert.go (#664)
20aeab4 util: gtld_map autopull updates for 2022-04-15T16:45:51 UTC (#671)
6d874e6 updating to zcrypto 599ec18 (#670)
b3be71c Skip checking for a Tor Descriptor Hash if the provided cert contains a V3 Onion address. (#669)
3be391b Update README.md (#666)
b1bd967 No underscores are allowed in DNSNames before BR 1.6.2's permissibility period (#659)
6badb89 No underscores are allowed in DNSNames after BR 1.6.2's permissibility period (#662)
4ab8567 util: gtld_map autopull updates for 2022-02-17T22:26:31 UTC (#658)
7fc9fbd Add Microsoft to the known-ZLint users (#655)
b4a225e AlgorithmIdentifier encoding (Section 7.1.3.1, CAB-Forum BR) (#642)
da67a23 util: gtld_map autopull updates for 2021-12-30T02:43:35 UTC (#654)
3f7cf6c Update README.md (#653)
9199b6d util: gtld_map autopull updates for 2021-12-09T20:29:24 UTC (#649)
0d71258 Entrust Datacard rebranded to Entrust (#652)
bbc7e36 Add lint to detect IP addresses in EV certs (#650)
cb3e7e8 Mark CA/Browser Forum EV Policy OID as EV (#651)
da4e374 refactor: move from io/ioutil to io and os packages (#647)
3a3de3c util: gtld_map autopull updates for 2021-10-30T04:36:00 UTC (#637)
2ff2130 cleaning up some datetime logic (#644)
cb17369 Lint for Non-XN Reserved Labels (#635)
9113ed8 Forbid wildcard certs for non .onion EVs (#641)
0508b86 Detect XN-Labels case-insensitively (#636)
b6ec327 util: gtld_map autopull updates for 2021-10-05T22:26:49 UTC (#633)

ZLint v3.3.1-rc2

ZLint v3.3.1-rc2

The ZMap team is happy to share ZLint v3.3.1-rc2.

Thank you to everyone who contributes to ZLint!

The following changes are what have occurred since v3.3.1-rc1

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• No new lints

Bug Fixes:

• No bug fixes.

Misc:

• The ZLint project has been updated to use the Go 1.18 toolchain.
• A GTLD update
• zcrypto was updated to point towards commit @599ec18ecbac.
• Various quality of life changes to the ZLint developer experience.

Changelog

• 74f4541 Update to Go 1.18 and update GolangCI Linter (#672)
• a34c016 QoL changes to genTestCert.go (#664)
• 20aeab4 util: gtld_map autopull updates for 2022-04-15T16:45:51 UTC (#671)
• 6d874e6 updating to zcrypto 599ec18 (#670)

ZLint v3.3.1-rc1

ZLint v3.3.1-rc1

The ZMap team is happy to share ZLint v3.3.1-rc1.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• e_ev_not_wildcard asserts that wildcard domains are not allowable for EV certificates (except .onion addresses).
• e_dnsname_contains_prohibited_reserved_label asserts that every label within a FQDN must be either a P-Label or a Non-Reserved LDH Label.
• e_ev_san_ip_address_present asserts that Subject Alternative Name MUST contain only dnsName types.
• e_algorithm_identifier_improper_encoding asserts CABF BR 7.1.3.1 regarding requiring a specific byte sequence within a Subject Public Key Info field.
• e_underscore_not_permissible_in_dnsname asserts that underscore are not permissible after the brief permissibility period described in CABF BR 1.6.2.
• e_no_underscores_before_1_6_2 asserts that underscore are not permissible before the brief permissibility period described in CABF BR 1.6.2.

Bug Fixes:

• Corrected an issue in lint_idn_dnsname_malformed_unicode and lint_idn_dnsname_must_be_nfc wherein the IDNA ACE prefixes were incorrectly considered to be case-sensitive.
• A Tor Hash Descriptor is no longer required on certificates that encode Onion V3 addresses.

Misc:

• Numerous TLD updates.
• The CABF OID for EV (2.23.140.1.1) was added as a known EV OID.
• Some clearer datetime logic for more natural daterange checking.

Changelog

b3be71c Skip checking for a Tor Descriptor Hash if the provided cert contains a V3 Onion address. (#669)
3be391b Update README.md (#666)
b1bd967 No underscores are allowed in DNSNames before BR 1.6.2's permissibility period (#659)
6badb89 No underscores are allowed in DNSNames after BR 1.6.2's permissibility period (#662)
4ab8567 util: gtld_map autopull updates for 2022-02-17T22:26:31 UTC (#658)
7fc9fbd Add Microsoft to the known-ZLint users (#655)
b4a225e AlgorithmIdentifier encoding (Section 7.1.3.1, CAB-Forum BR) (#642)
da67a23 util: gtld_map autopull updates for 2021-12-30T02:43:35 UTC (#654)
3f7cf6c Update README.md (#653)
9199b6d util: gtld_map autopull updates for 2021-12-09T20:29:24 UTC (#649)
0d71258 Entrust Datacard rebranded to Entrust (#652)
bbc7e36 Add lint to detect IP addresses in EV certs (#650)
cb3e7e8 Mark CA/Browser Forum EV Policy OID as EV (#651)
da4e374 refactor: move from io/ioutil to io and os packages (#647)
3a3de3c util: gtld_map autopull updates for 2021-10-30T04:36:00 UTC (#637)
2ff2130 cleaning up some datetime logic (#644)
cb17369 Lint for Non-XN Reserved Labels (#635)
9113ed8 Forbid wildcard certs for non .onion EVs (#641)
0508b86 Detect XN-Labels case-insensitively (#636)
b6ec327 util: gtld_map autopull updates for 2021-10-05T22:26:49 UTC (#633)

ZLint v3.3.0

ZLint v3.3.0

The ZMap team is happy to share ZLint v3.3.0.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• e_sub_ca_aia_missing was split into two lints - e_sub_ca_aia_missing and w_sub_ca_aia_missing. The error variant becomes ineffective for certificates issued after August 20th, 2020. Conversely, the warning variant becomes effective for certificates issued after August 20th, 2020.
• e_subject_common_name_not_exactly_from_san. The common name field in subscriber certificates must include only names from the SAN extension.
• e_rfc_dnsname_empty_label. DNSNames should not have an empty label.
• e_rfc_dnsname_hyphen_in_sld. . DNSName should not have a hyphen beginning or ending the SLD.
• e_rfc_dnsname_label_too_long. DNSName labels MUST be less than or equal to 63 characters.
• e_rfc_dnsname_underscore_in_sld. DNSName MUST NOT contain underscore characters.
• w_rfc_dnsname_underscore_in_trd. DNSName MUST NOT contain underscore characters.

Bug Fixes:

• The ZCrypto dependency was upgraded to v0.0.0-20210811211718-6f9bc4aff20f in order to fix issue #626, which was causing a compilation error when attempting to consume ZLint as a library rather than a binary application.
• A bug was fixed in the project's test certificate generation script wherein generated sample certificates did not properly cryptographically chain

Misc:

• All lints had their initialize methods migrated to proper Go style constructors. This reduces the reliance upon singletons in the code base and improves multi-threaded test stability.
• The ZLint test integration framework now rejects config.json files that have duplicate entries. This improves reasoning of test results as duplicate definitions elsewhere in the could unknowingly override test expectations.
• Updated ZCrypto to allow for more permissive ASN.1 parsing.
• e_subject_common_name_not_from_san was configured to no longer be effective as of CABF 1.8.0.

Changelog

1b89405 bump zcrypto to v0.0.0-20210811211718-6f9bc4aff20f (#629)
9da3c9f disallow duplicate entries in config.json (#616)
4940d55 Test certificate generator doesn't create a certificate chain (#622)
e274215 split lint_sub_ca_aia_missing lint into an error lint for before CABF_BR 1.7.1 and a warning for after. Add test data (#613)
7bba362 Code clarification to match BRs wording. (#621)
48b300e Update README.md (#614)
8e8930e subsitute the initialize method for a constructor in the Lint struct (#607)
dbd9bfd dep: upgrade to latest ZCrypto with permissive asn1 parsing (#611)
b4060ec Correct lint attribution for dnsname_etc lints and limit scope to just DNS SAN entries (#609)
74dfff2 Update README.md (#631)
0944e91 e_subject_common_name_not_from_san is no longer sufficient for enforcing CABF BRs (#627)

v3.3.0-rc2

ZLint v3.3.0-rc2

The ZMap team is happy to share ZLint v3.3.0-rc2.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• e_sub_ca_aia_missing was split into two lints - e_sub_ca_aia_missing and w_sub_ca_aia_missing. The error variant becomes ineffective for certificates issued after August 20th, 2020. Conversely, the warning variant becomes effective for certificates issued after August 20th, 2020.
• e_subject_common_name_not_exactly_from_san. The common name field in subscriber certificates must include only names from the SAN extension.
• e_rfc_dnsname_empty_label. DNSNames should not have an empty label.
• e_rfc_dnsname_hyphen_in_sld. . DNSName should not have a hyphen beginning or ending the SLD.
• e_rfc_dnsname_label_too_long. DNSName labels MUST be less than or equal to 63 characters.
• e_rfc_dnsname_underscore_in_sld. DNSName MUST NOT contain underscore characters.
• w_rfc_dnsname_underscore_in_trd. DNSName MUST NOT contain underscore characters.

Bug Fixes:

• The ZCrypto dependency was upgraded to v0.0.0-20210811211718-6f9bc4aff20f in order to fix issue #626, which was causing a compilation error when attempting to consume ZLint as a library rather than a binary application.
• A bug was fixed in the project's test certificate generation script wherein generated sample certificates did not properly cryptographically chain

Misc:

• All lints had their initialize methods migrated to proper Go style constructors. This reduces the reliance upon singletons in the code base and improves multi-threaded test stability.
• The ZLint test integration framework now rejects config.json files that have duplicate entries. This improves reasoning of test results as duplicate definitions elsewhere in the could unknowingly override test expectations.
• Updated ZCrypto to allow for more permissive ASN.1 parsing.
• e_subject_common_name_not_from_san was configured to no longer be effective as of CABF 1.8.0.

Changelog

1b89405 bump zcrypto to v0.0.0-20210811211718-6f9bc4aff20f (#629)
9da3c9f disallow duplicate entries in config.json (#616)
4940d55 Test certificate generator doesn't create a certificate chain (#622)
e274215 split lint_sub_ca_aia_missing lint into an error lint for before CABF_BR 1.7.1 and a warning for after. Add test data (#613)
7bba362 Code clarification to match BRs wording. (#621)
48b300e Update README.md (#614)
8e8930e subsitute the initialize method for a constructor in the Lint struct (#607)
dbd9bfd dep: upgrade to latest ZCrypto with permissive asn1 parsing (#611)
b4060ec Correct lint attribution for dnsname_etc lints and limit scope to just DNS SAN entries (#609)
74dfff2 Update README.md (#631)
0944e91 e_subject_common_name_not_from_san is no longer sufficient for enforcing CABF BRs (#627)

ZLint v3.3.0-rc1

ZLint v3.3.0-rc1

The ZMap team is happy to share ZLint v3.3.0-rc1.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• e_sub_ca_aia_missing was split into two lints - e_sub_ca_aia_missing and w_sub_ca_aia_missing. The error variant becomes ineffective for certificates issued after August 20th, 2020. Conversely, the warning variant becomes effective for certificates issued after August 20th, 2020.

Bug Fixes:

• The ZCrypto dependency was upgraded to v0.0.0-20210811211718-6f9bc4aff20f in order to fix issue #626, which was causing a compilation error when attempting to consume ZLint as a library rather than a binary application.
• A bug was fixed in the project's test certificate generation script wherein generated sample certificates did not properly cryptographically chain

Misc:

• All lints had their initialize methods migrated to proper Go style constructors. This reduces the reliance upon singletons in the code base and improves multi-threaded test stability.
• The ZLint test integration framework now rejects config.json files that have duplicate entries. This improves reasoning of test results as duplicate definitions elsewhere in the could unknowingly override test expectations.
• Updated ZCrypto to allow for more permissive ASN.1 parsing.

Changelog

1b89405 bump zcrypto to v0.0.0-20210811211718-6f9bc4aff20f (#629)
9da3c9f disallow duplicate entries in config.json (#616)
4940d55 Test certificate generator doesn't create a certificate chain (#622)
e274215 split lint_sub_ca_aia_missing lint into an error lint for before CABF_BR 1.7.1 and a warning for after. Add test data (#613)
7bba362 Code clarification to match BRs wording. (#621)
48b300e Update README.md (#614)
8e8930e subsitute the initialize method for a constructor in the Lint struct (#607)
dbd9bfd dep: upgrade to latest ZCrypto with permissive asn1 parsing (#611)

ZLInt v3.2.0

ZLint v3.2.0

The ZMap team is happy to share ZLint v3.2.0.

Thank you to everyone who contributes to ZLint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• w_subject_given_name_recommended_max_length, RFC 5280

  X.411 (1988) describes ub-common-name-length to be 64 bytes long. As systems may have targeted this length, for compatibility purposes it may be prudent to limit given names to this length.

• e_prohibit_dsa_usage, Mozilla Root Store Policy - §5.1

  The usage of DSA as the public key algorithm is no longer allowed. Effective March 31st, 2017.

• e_br_prohibit_dsa_usage, CABF Baseline requirements, v1.7.1

  DSA was removed from the Baseline Requirements as a valid signature algorithm in 1.7.1. Effective August 20th, 2020.

Bug Fixes:

• e_serial_number_not_positive no longer considers zero to be valid.
• e_subject_given_name_max_length now checks whether given names are under 32769 characters long (was 17).
• e_subject_surname_max_length now checks whether given names are under 32769 characters long (was 17).
• e_dsa_params_missing is no longer effective as of August 20th, 2020.

Misc:

• Updated TLD data (Current to 2021-04-22).
• ZCrypto dependency bumped to ea3fdbd5ea2.
• Switched ZLint to Go 1.16.
• Added the -version flag to zlint/zlint-gtld-update.
• Added support for IneffectiveDate in lints, which complements EffectiveDate and marks when a lint is superseded by another or is otherwise no longer enforced.
• A certificate generating playground tool was added under v3/cmd/genTestCerts/. This script should hopefully accelerate the process of generating test certificates for most edge cases.
• Added static analysis to the repository which enforces function ordering in lints in CI/CD.
• Miscellaneous typos.

Changelog

7e75dc3 deps: update zcrypto to ea3fdbd (#604)
d5d0ed9 lints: fix anyKeyUsage typo in n_mp_allowed_eku. (#600)
c47eab4 cmd: add -version to zlint, zlint-gtld-update. (#598)
0807bf9 Updating RFC surname and givenname character limits (#586)
3de0a7c util: gtld_map autopull updates for 2021-04-22T03:40:32 UTC (#590)
5ca3470 util: gtld_map autopull updates for 2021-04-21T21:31:31 UTC (#589)
740b212 util: gtld_map autopull updates for 2021-04-17T02:48:14 UTC (#588)
d5ab97e Make zero an invalid serial number for RFC lints (#584)
2cac1fd Lint that DSA is not used - BR (#577)
30c55c5 lints: fix typo in e_ext_name_constraints_not_critical description (#579)
a6348f9 Update zcrypto for vendored crypto/dsa package (#578)
35273f1 util: gtld_map autopull updates for 2021-03-26T21:30:44 UTC (#580)
b313d9f Introduce an upper bounds to effective dates (#576)
3223b2a Add a new lint to prohibit using DSA (#572)
3615e0f Include a playground script for generating one off certificates and certificate chains (#569)
7fcf0da util: gtld_map autopull updates for 2021-02-19T22:31:45 UTC (#571)
2aa588f project: switch to go 1.16. (#570)
1f157ab Lint template produces a file with an init function that is not at the top of the new lint (#565)
835500b Custom static analysis tooling for CI/CD (#551)
1cbdd0c docs: update CONTRIBUTING.md with cert generation resources (#560)
59e0d78 util: gtld_map autopull updates for 2021-02-11T11:26:01 UTC (#563)
f091dd3 deps: update zcrypto to 2a2d9c3 (#562)

v3.2.0-rc1

ZLint v3.2.0-rc1

The ZMap team is happy to share ZLint v3.2.0-rc1.

Thank you to everyone who contributes to Zlint!

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• w_subject_given_name_recommended_max_length, RFC 5280

  X.411 (1988) describes ub-common-name-length to be 64 bytes long. As systems may have targeted this length, for compatibility purposes it may be prudent to limit given names to this length.

• e_prohibit_dsa_usage, Mozilla Root Store Policy - §5.1

  The usage of DSA as the public key algorithm is no longer allowed. Effective March 31st, 2017.

• e_br_prohibit_dsa_usage, CABF Baseline requirements, v1.7.1

  DSA was removed from the Baseline Requirements as a valid signature algorithm in 1.7.1. Effective August 20th, 2020.

Bug Fixes:

• e_serial_number_not_positive no longer considers zero to be valid.
• e_subject_given_name_max_length now checks whether given names are under 32769 characters long (was 17).
• e_subject_surname_max_length now checks whether given names are under 32769 characters long (was 17).
• e_dsa_params_missing is no longer effective as of August 20th, 2020.

Misc:

• Updated TLD data (Current to 2021-04-22).
• ZCrypto dependency bumped to ea3fdbd5ea2.
• Switched ZLint to Go 1.16.
• Added the -version flag to zlint/zlint-gtld-update.
• Added support for IneffectiveDate in lints, which complements EffectiveDate and marks when a lint is superseded by another or is otherwise no longer enforced.
• A certificate generating playground tool was added under v3/cmd/genTestCerts/. This script should hopefully accelerate the process of generating test certificates for most edge cases.
• Added static analysis to the repository which enforces function ordering in lints in CI/CD.
• Miscellaneous typos.

Changelog

7e75dc3 deps: update zcrypto to ea3fdbd (#604)
d5d0ed9 lints: fix anyKeyUsage typo in n_mp_allowed_eku. (#600)
c47eab4 cmd: add -version to zlint, zlint-gtld-update. (#598)
0807bf9 Updating RFC surname and givenname character limits (#586)
3de0a7c util: gtld_map autopull updates for 2021-04-22T03:40:32 UTC (#590)
5ca3470 util: gtld_map autopull updates for 2021-04-21T21:31:31 UTC (#589)
740b212 util: gtld_map autopull updates for 2021-04-17T02:48:14 UTC (#588)
d5ab97e Make zero an invalid serial number for RFC lints (#584)
2cac1fd Lint that DSA is not used - BR (#577)
30c55c5 lints: fix typo in e_ext_name_constraints_not_critical description (#579)
a6348f9 Update zcrypto for vendored crypto/dsa package (#578)
35273f1 util: gtld_map autopull updates for 2021-03-26T21:30:44 UTC (#580)
b313d9f Introduce an upper bounds to effective dates (#576)
3223b2a Add a new lint to prohibit using DSA (#572)
3615e0f Include a playground script for generating one off certificates and certificate chains (#569)
7fcf0da util: gtld_map autopull updates for 2021-02-19T22:31:45 UTC (#571)
2aa588f project: switch to go 1.16. (#570)
1f157ab Lint template produces a file with an init function that is not at the top of the new lint (#565)
835500b Custom static analysis tooling for CI/CD (#551)
1cbdd0c docs: update CONTRIBUTING.md with cert generation resources (#560)
59e0d78 util: gtld_map autopull updates for 2021-02-11T11:26:01 UTC (#563)
f091dd3 deps: update zcrypto to 2a2d9c3 (#562)

v3.1.0

ZLint v3.1.0

The ZMap team is happy to share ZLint v3.1.0.

Thank you to everyone who contributes to Zlint; whether it be code, knowledge, wisdom or the grace of all three you are appreciated.

Breaking Changes:

No breaking changes were made in this release.

New Lints:

• e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth, CABF Baseline Requirements - §4.9.9

  OCSP signing Certificate MUST contain an extension of type id-pkixocsp-nocheck, as defined by RFC6960.

• e_ev_organization_id_missing lint, CABF EV Guidelines v1.7.0 - §9.8.2

  Effective January 31, 2020, if the subject:organizationIdentifier field is present, this [cabfOrganizationIdentifier] field MUST be present.

• e_name_constraint_not_fqdn, RFC 5280 - §4.2.1.10

  For URIs, the constraint MUST be specified as a fully qualified domain name [...] When the constraint begins with a period, it MAY be expanded with one or more labels.

Bug Fixes:

• e_serial_number_longer_than_20_octets has been corrected to count the number of octets taken to represent a serial number after it has been serialized to ASN.1. Since ASN.1 numbers are signed values, serial numbers that are greater-than-or-equal-to 2^160 will begin to fail this lint as they are prefixed with a 0x00 to maintain their positive sign.
• Previously the e_ext_duplicate_extension lint from the lint.RFC5280 source only returned a lint.Error result as soon as one duplicate extension was found in a certificate. It did not indicate which extension OID was duplicated, or if there was more than one duplicated extensions. In this release, the lint now does both of these things. The detail string now indicates all of the extension OIDs that were present more than once.

Misc:

• Updated TLD data (Current to 2020-12-11).
• ZCrypto dependency bumped to 9cf5bea.
• Changed the project style guide to asking that lints have their init function declared near the top of the file as it often contains the most useful information for outside readers.
• Removed an unused utility function.
• Copyright updated to 2021.

Full Changelog

848c50b integration: fix resultCount types to not overflow, update expected vals. (#557)
12bb0ed lints: revert e_key_usage_and_extended_key_usage_inconsistent. (#556)
c1c6681 lints: fix description of e_ext_ian_uri_not_ia5 (#554)
2549ed3 lints: return detail for e_ext_duplicate_extension. (#550)
6dde095 deps: update zcrypto to 9cf5bea (#548)
3094399 tests: coverage for e_name_constraint_not_fqdn detail msgs (#547)
ea23311 lints: move init to start of lint_name_constraint_not_fqdn.go (#544)
6d643b9 project: re-order lint init functions (#536)
edd0d0c lints: adds e_name_constraint_not_fqdn lint (RFC5280 4.2.1.10) (#533)
186e2c1 project: update copyright year to 2021 (#543)
5316fa5 lints: adds e_ev_organization_id_missing lint (CABF EVG 1.7.0 Section 9.8.2) (#532)
b0e20c8 docs: CONTRIBUTING.md updates, couple copyright year tweaks. (#535)
747b41f lints: fix boundary condition in e_serial_number_longer_than_20_octets lint (#527)
3042438 KU and EKU Inconsistent lint correction (#528)
4d0ac7a deps: update zmap/zcrypto to 1eef276 (#529)
b691fe9 Added a new lint and tests for correlation between KU&EKU (#497)
a1b837a deps: update zmap/zcrypto to deeac00. (#526)
9e16bfc util: remove unused ICANNPublicSuffixParse helper. (#525)
f47c9d6 CI: Cleanup hacky tld-update workflow env var use. (#524)
d8314a3 CI: Have tld-update workflow build & test pre-PR. (#521)
83f15ca util: gtld_map autopull updates for 2020-12-11T05:27:56 UTC (#520)
b6e5ba7 util: gtld_map autopull updates for 2020-12-08T18:31:14 UTC (#518)
1eb11ce Ocsp eku check for tls certificates (#490)
662504d change tld updator to not be me (#516)
931c5d4 util: gtld_map autopull updates for 2020-11-30T23:23:57 UTC (#514)
12dfc18 CI: Add cron workflow for gTLD update PRs. (#513)