Skip to content

Update zcrypto and use its crypto/rsa fork#1045

Merged
zakird merged 1 commit into
masterfrom
adapt_to_new_zcrypto_rsa_library
May 14, 2026
Merged

Update zcrypto and use its crypto/rsa fork#1045
zakird merged 1 commit into
masterfrom
adapt_to_new_zcrypto_rsa_library

Conversation

@robstradling

@robstradling robstradling commented May 14, 2026

Copy link
Copy Markdown
Member

zmap/zcrypto@f72a0b5 has forked crypto/rsa.

Earlier today https://dev.pkimet.al/ was running zlint-latest built with zcrypto-latest, which caused all certificates with RSA keys to receive this treatment:
image

This PR updates the zcrypto dependency in each of this repository's go.mod files, updates the imports in each affected file to use the github.com/zmap/zcrypto/rsa fork instead of crypto/rsa, and updates the various lints that now need to deal with a big.Int public exponent.

@zakird zakird merged commit ec384e2 into master May 14, 2026
8 checks passed
@zakird zakird deleted the adapt_to_new_zcrypto_rsa_library branch May 14, 2026 15:06
@christopher-henderson

christopher-henderson commented May 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Thank you very much @robstradling and @zakird for quick resolution.

I have made pre-release at v.3.7.1-rc1 for https://dev.pkimet.al/ to test the fix against.

I am quite curious as to how this made it past the integration test suite. If folks have a notion on how this made it out into the wild then I would be happy to close the testing gap on that.

@robstradling

robstradling commented May 17, 2026

Copy link
Copy Markdown
Member Author

@christopher-henderson: It was only with the merging of this PR that the Zlint repository pulled in the updated zcrypto version. Would the integration test suite have ever been run against the updated zcrypto version prior to that? (I'm guessing not).
Whereas the pkimetal dev channel automatically pulled in the updated zcrypto version soon after zmap/zcrypto@f72a0b5 was committed; and this was automatically deployed to https://dev.pkimet.al/ soon after that; and then the Sectigo QA team noticed preissuance linting breakage (because the QA environment for our CA uses https://dev.pkimet.al/).
You would have undoubtedly run into the same issue sooner or later, whenever you next did a periodic update of dependencies. I just happened to run into it first.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zakird zakird zakird approved these changes

@christopher-henderson christopher-henderson Awaiting requested review from christopher-henderson

@phillip-stephens phillip-stephens Awaiting requested review from phillip-stephens

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@robstradling @christopher-henderson @zakird