[1.0.6] - 2026-04-08

Fixed

• Fixed a bug where the verification incorrectly picked the leaf certificate. This
  allowed an attacker who could modify a timestamp response to make a
  legitimately-signed timestamp from TSA-A pass verification as if it came from
  TSA-B.

[1.0.5] - 2025-09-23

Changed

• Bump pyca/cryptography dependency upper bound to version 47

[1.0.4] - 2025-08-11

Changed

• Timestamps are now verified with the timestamp time as reference time like the RFC
  says: this means that the certificate chain no longer needs to be valid at current
  time, it is enough for it to have been valid at timestamp time
  (#174)

[1.0.3] - 2025-06-20

Fixed

• Exposed verify_message in the actual Verify interface, not just the implementation
  (#153)

• Fixed a bug where verification performed insufficient signature checks on
  the timestamp response itself, rather than the response's certificate chain

Changed

• Added HashAlgorithm to exports of the base package module (#143)

• Added verify_message method to Verifier class (#144)

• Slight refactoring of the tests to ease how to test with multiple TSA (#145)

• Changed return value of VerifierBuilder.build() from _Verifier to Verifier: This is technically
  an API change but should have minimal user impact. (#147)

Fixed

• Fixed spelling of hash_algorithm parameter in TimestampRequestBuilder class (#131)

What's changed?

Fixed

• The Verifier now enforces that the EKU (Extended Key Usage) explicitly includes the id-kp-timeStamping OID (#120)

• The Verifier now searches for the leaf certificate in the Timestamp Response instead of using the first one provided (#121)

New Contributors

• @pjrobertson made their first contribution in #121

Full Changelog: v1.0.0...v1.0.1

What's Changed

• TimestampRequest now accepts setting the hash algorithm to SHA256 (in addition to SHA512) (#93)

Full Changelog: v0.1.2...v1.0.0

Changed

• Moved maturin dependency from main project dependencies to development dependencies
  since it's only needed for development tasks (88)

• Relax cryptography version requirement (91)

What's Changed

Changed

• rfc3161-client release 0.1.0 was previously published and yanked on PyPI, preventing republication (#85)

What's Changed

• rfc3161-client is now in beta (#82).