RepoJournal
Go @golang
103 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-06
stories 5
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

crypto/x509 tightens URI and email name constraint matching

By RepoJournal · Filed · About Go

Daniel McCarney Alan Donovan
2 people shipped this
Daniel McCarney @cpu 4 cited Alan Donovan @adonovan 1 cited

Three crypto/x509 commits from Daniel McCarney align name-constraint handling with RFC 5280, restricting URI and email constraints to exact hosts and rejecting empty GeneralSubtrees sequences.

crypto/x509 now applies host constraint matching to URI name constraints instead of DNS subtree matching [1]. Previously "example.com" matched subdomains; it now matches only the exact host, while constraints with a leading period keep domain-wide behavior. This also stops treating "*."-prefixed URI hosts as DNS wildcards for excluded constraints. The same treatment extends to email constraints: a bare email constraint without an @ or leading period now matches mailboxes at one exact host rather than all subdomains [2]. Matching preserves sorted lookup and pruning, distinguishing exact hosts from leading-period domain constraints.

The verifier now rejects NameConstraints extensions when either permittedSubtrees or excludedSubtrees is present with an empty sequence [3]. Previously only a fully empty extension was rejected. The change aligns with BoringSSL's pki verifier, and the x509-limbo corpus adds coverage for the new and existing behaviors [4]. In a separate cmd/go fix, vet export data is now preserved in memory for dependent actions when a package fails diagnostics, ensuring downstream vetting and testing proceed correctly [5].

$ ls golang/reviews/ # the step-back reads

the week in review crypto/ssh CheckCert enforces source address the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive →

Quick answers

What shipped in Go on September 6, 2026?
Three crypto/x509 commits from Daniel McCarney align name-constraint handling with RFC 5280, restricting URI and email constraints to exact hosts and rejecting empty GeneralSubtrees sequences. In total, 5 commits landed.
Who contributed to Go on September 6, 2026?
2 developers shipped this update, including Daniel McCarney and Alan Donovan.
What were the notable Go updates?
crypto/x509: restrict URI constraints to exact hosts, crypto/x509: restrict bare email constraints to exact hosts, and crypto/x509: reject empty GeneralSubtrees sequences.
♥

$ log @golang --recent

crypto/tls frees pinned buffers, compiler tail call DCE fix lands 26 shipped Plugin itabs double-inserted; symbol insertion skips large modules 12 shipped x/tools protocol shift, masked heap prefix fix 31 shipped Go compiler drops unnecessary riscv64 masking and hardens SIMD codegen 25 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.