ssh: reject empty certificate principals CheckCert did not reject an empty principal, so a certificate that lists an empty principal was accepted for an empty user name or host name. Both can occur: the server accepts an empty user name, and an address such as ":22" has an empty host name. Never match an empty principal, and reject an empty entry in ValidPrincipals in SignCert, as ssh-keygen does. A certificate holding one still parses, as in OpenSSH, and its other principals still match. Fixes golang/go#81539 Change-Id: I9d33113c68dcd3f40914bf6de87613902542619e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/844646 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This repository holds supplementary Go cryptography packages.
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with “x/crypto:” in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.