)]}'
{
  "commit": "39dc44e69c280a6254fa09ce85477455efeaf6a2",
  "tree": "b8090bdd416e0e3b4385a472def9f4db670f028d",
  "parents": [
    "afebf4cb4efb2b854282e03160da67120707f8f7"
  ],
  "author": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Tue Aug 18 10:22:35 2026 +0200"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Sun Aug 30 20:04:51 2026 -0700"
  },
  "message": "ssh: don\u0027t skip the source-address critical option in CheckCert\n\nCertChecker.CheckCert ignored source-address on the assumption that\nserverAuthenticate would enforce it, but that only happens in the\nserver-side user authentication path. Nothing enforced it in the host key\npath, so CheckHostKey accepted CA-signed host certificates carrying\nsource-address regardless of the server\u0027s address, and the same applied to\napplications calling CheckCert directly.\n\nDrop the special case: every critical option must be listed in\nSupportedCriticalOptions, host and user certificates alike. Authenticate,\nthe only path where serverAuthenticate does enforce source-address, checks\nagainst a copy of the CertChecker with that option appended.\n\nFixes golang/go#80872\n\nChange-Id: I3c3554b71ea2a4ce4b17696a9596b973b7d74b00\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/816840\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fa848f51a5f9be5dadf7b2518e9bad5ff4ec6477",
      "old_mode": 33188,
      "old_path": "ssh/certs.go",
      "new_id": "a3b802e4b8bfc870d681b44f41a051f716b635bd",
      "new_mode": 33188,
      "new_path": "ssh/certs.go"
    },
    {
      "type": "modify",
      "old_id": "8358b33e5e77ef68d813a4352ff841cad84f4c7e",
      "old_mode": 33188,
      "old_path": "ssh/certs_test.go",
      "new_id": "ad5ddfdf1bdba4130286c93c4f7340549df2a4d1",
      "new_mode": 33188,
      "new_path": "ssh/certs_test.go"
    }
  ]
}