go-x-crypto, branch v0.41.0

go.mod: update golang.org/x dependencies

2025-08-07T17:21:04Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I93de641462a54b0ae565bb60e2a0e6e7c2c3b883 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/693999 LUCI-TryBot-Result: Go LUCI Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: David Chase

acme: fix pebble subprocess output data race

2025-08-06T20:33:03Z

Wait for process completion before reading stdout/stderr buffers to eliminate race between I/O Go routines and test cleanup. Updates golang/go#74437 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest-race Change-Id: I2e650c04db5be0d7a1e858ce40e25f13ad12223c Reviewed-on: https://go-review.googlesource.com/c/crypto/+/693596 Auto-Submit: Daniel McCarney Reviewed-by: Roland Shoemaker Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI

x509roots/fallback: store bundle certs directly in DER

2025-08-03T19:47:17Z

goos: linux goarch: amd64 pkg: golang.org/x/crypto/x509roots/fallback cpu: AMD Ryzen 5 4600G with Radeon Graphics │ /tmp/before │ /tmp/after │ │ sec/op │ sec/op vs base │ InitTime-12 1.726m ± 0% 1.101m ± 1% -36.20% (p=0.000 n=30) │ /tmp/before │ /tmp/after │ │ B/op │ B/op vs base │ InitTime-12 1178.2Ki ± 0% 779.8Ki ± 0% -33.81% (p=0.000 n=30) │ /tmp/before │ /tmp/after │ │ allocs/op │ allocs/op vs base │ InitTime-12 11.35k ± 0% 10.64k ± 0% -6.32% (p=0.000 n=30) Updates golang/go#73691 Change-Id: Ic33f2fdfc65001c41afeb3b6af8a383288d10de6 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676217 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Mark Freeman

acme: increase pebble test waitForServer attempts

2025-08-01T15:44:22Z

In CI it seems that occasionally we can't connect to the test servers within 10 tries, and the test flakes. Let's give the process more attempts. Updates golang/go#74437 Change-Id: I74d6cea83468a3a572ec4b52ff7314c778c664cf Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/crypto/+/692075 Auto-Submit: Daniel McCarney Reviewed-by: Roland Shoemaker Reviewed-by: Mark Freeman LUCI-TryBot-Result: Go LUCI

x509roots/fallback: update bundle

2025-07-30T23:29:44Z

This is an automated CL which updates the NSS root bundle. [git-generate] go generate ./x509roots Change-Id: Ib30b702d41dedacce835628a9dab456098be0703 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/687895 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Auto-Submit: Gopher Robot

acme: capture pebble test subprocess stdout/stderr

2025-07-11T19:27:10Z

When spawning the pebble and pebble-challtestserv processes redirect stdout/stderr to bytes.Buffer instances and print their content at test end as appropriate. The stdout/stderr content for each process is printed if the test failed, or if testing is being done in verbose mode. Otherwise the output is swallowed. This makes debugging test failures much easier as output from the subprocesses from independent tests isn't intermingled. Updates golang/go#74437 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: Ia79a3609ce3522ef6248442de247554c39367162 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/686935 Auto-Submit: Daniel McCarney Reviewed-by: Roland Shoemaker Reviewed-by: Carlos Amedee LUCI-TryBot-Result: Go LUCI

go.mod: update golang.org/x dependencies

2025-07-10T17:21:43Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I3a89b1890ad2f7d2b2c23e1efce60c19e43dd381 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/687017 Reviewed-by: Dmitri Shuralyov Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: David Chase

ssh: add AlgorithmNegotiationError

2025-07-09T15:43:26Z

Fixes golang/go#61536 Change-Id: Id38cc6d46879dbe2bdea04dec061596387ec6cfe Reviewed-on: https://go-review.googlesource.com/c/crypto/+/559056 LUCI-TryBot-Result: Go LUCI Reviewed-by: Filippo Valsorda Reviewed-by: David Chase Auto-Submit: Nicola Murino Reviewed-by: Carlos Amedee

acme: fix TLSALPN01ChallengeCert for IP address identifiers

2025-06-30T19:50:50Z

When creating a TLS-ALPN-01 challenge response certificate for an IP address identifier we need to configure the template IPAddresses field, not the DNSNames/Subject.CommonName. Along the way we can do some small tidying: * Updating the draft TLS-ALPN-01 reference to the finalized RFC * Adding a reference to the IP address identifier ACME RFC * Adding a mention of the form the challenge validation request's SNI will take when verifying an IP address identifier * Tidying the private tlsChallengeCert() function to take a single identifier as arg since the only call-sites provide singular values since the removal of the TLS-SNI-[01|02] challenge helpers. This allows enabling an IP address identifier in the Pebble integration tests that otherwise caused a validation failure for TLS-ALPN-01 challenge types because the IP address was used as a DNS SAN. Updates golang/go#73914 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: Ic671e41b585f424f821db65206c7ffcc6dd386a0 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/677576 Reviewed-by: Ian Stapleton Cordasco Auto-Submit: Daniel McCarney Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov

acme: add Pebble integration testing

2025-06-30T16:51:57Z

This commit adds integration test coverage for a complete TLS-ALPN-01 and HTTP-01 based issuance flow. For each tested challenge type we: * Spin up a pebble/pebble-challtestsrv environment * Spin up a small challenge response server * Create an ACME account * Create an order for multiple DNS type identifiers * Provision challenge responses based on the challenge type under test * Wait for the order to become ready for issuance * Finalize the order, issuing a certificate * Check the newly issued certificate chain validates with the Pebble trust anchor, and that the certificate is valid for each of the names from our initial order These tests are skipped in short mode (Pebble has variable delays for validation requests). The Pebble source is fetched through the Go module proxy (unless a local directory is specified to aid development), similar to how the stdlib crypto packages fetch BoGo tooling. More test coverage for various other parts of the protocol (key rollover, account/authz deactivation, revocation, etc) can be added as follow-up work now that the groundwork for integration testing is laid. Fixes golang/go#73914 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: I4e79f4858f31ef290a0c91d345e15fbdc510e9ab Reviewed-on: https://go-review.googlesource.com/c/crypto/+/677575 Reviewed-by: Roland Shoemaker Auto-Submit: Daniel McCarney Reviewed-by: Ian Stapleton Cordasco Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI