@ttsc/win32-arm64 0.33.0 → 0.34.0

package/bin/go/src/crypto/x509/root_plan9.go

@@ -6,34 +6,13 @@
 
 package x509
 
-import (
-	"os"
-)
-
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
 	"/sys/lib/tls/ca.pem",
 }
 
+var certDirectories = []string{}
+
 func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate, err error) {
 	return nil, nil
 }
-
-func loadSystemRoots() (*CertPool, error) {
-	roots := NewCertPool()
-	var bestErr error
-	for _, file := range certFiles {
-		data, err := os.ReadFile(file)
-		if err == nil {
-			roots.AppendCertsFromPEM(data)
-			return roots, nil
-		}
-		if bestErr == nil || (os.IsNotExist(bestErr) && !os.IsNotExist(err)) {
-			bestErr = err
-		}
-	}
-	if bestErr == nil {
-		return roots, nil
-	}
-	return nil, bestErr
-}

package/bin/go/src/crypto/x509/root_unix.go

@@ -6,103 +6,6 @@
 
 package x509
 
-import (
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-const (
-	// certFileEnv is the environment variable which identifies where to locate
-	// the SSL certificate file. If set this overrides the system default.
-	certFileEnv = "SSL_CERT_FILE"
-
-	// certDirEnv is the environment variable which identifies which directory
-	// to check for SSL certificate files. If set this overrides the system default.
-	// It is a colon separated list of directories.
-	// See https://www.openssl.org/docs/man1.0.2/man1/c_rehash.html.
-	certDirEnv = "SSL_CERT_DIR"
-)
-
 func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate, err error) {
 	return nil, nil
 }
-
-func loadSystemRoots() (*CertPool, error) {
-	roots := NewCertPool()
-
-	files := certFiles
-	if f := os.Getenv(certFileEnv); f != "" {
-		files = []string{f}
-	}
-
-	var firstErr error
-	for _, file := range files {
-		data, err := os.ReadFile(file)
-		if err == nil {
-			roots.AppendCertsFromPEM(data)
-			break
-		}
-		if firstErr == nil && !os.IsNotExist(err) {
-			firstErr = err
-		}
-	}
-
-	dirs := certDirectories
-	if d := os.Getenv(certDirEnv); d != "" {
-		// OpenSSL and BoringSSL both use ":" as the SSL_CERT_DIR separator.
-		// See:
-		//  * https://golang.org/issue/35325
-		//  * https://www.openssl.org/docs/man1.0.2/man1/c_rehash.html
-		dirs = strings.Split(d, ":")
-	}
-
-	for _, directory := range dirs {
-		fis, err := readUniqueDirectoryEntries(directory)
-		if err != nil {
-			if firstErr == nil && !os.IsNotExist(err) {
-				firstErr = err
-			}
-			continue
-		}
-		for _, fi := range fis {
-			data, err := os.ReadFile(directory + "/" + fi.Name())
-			if err == nil {
-				roots.AppendCertsFromPEM(data)
-			}
-		}
-	}
-
-	if roots.len() > 0 || firstErr == nil {
-		return roots, nil
-	}
-
-	return nil, firstErr
-}
-
-// readUniqueDirectoryEntries is like os.ReadDir but omits
-// symlinks that point within the directory.
-func readUniqueDirectoryEntries(dir string) ([]fs.DirEntry, error) {
-	files, err := os.ReadDir(dir)
-	if err != nil {
-		return nil, err
-	}
-	uniq := files[:0]
-	for _, f := range files {
-		if !isSameDirSymlink(f, dir) {
-			uniq = append(uniq, f)
-		}
-	}
-	return uniq, nil
-}
-
-// isSameDirSymlink reports whether fi in dir is a symlink with a
-// target not containing a slash.
-func isSameDirSymlink(f fs.DirEntry, dir string) bool {
-	if f.Type()&fs.ModeSymlink == 0 {
-		return false
-	}
-	target, err := os.Readlink(filepath.Join(dir, f.Name()))
-	return err == nil && !strings.Contains(target, "/")
-}

package/bin/go/src/crypto/x509/root_windows.go

@@ -7,14 +7,14 @@ package x509
 import (
 	"bytes"
 	"errors"
+	"slices"
 	"strings"
 	"syscall"
 	"unsafe"
 )
 
-func loadSystemRoots() (*CertPool, error) {
-	return &CertPool{systemPool: true}, nil
-}
+// Windows has no default SSL_CERT_{FILE,DIR} paths.
+var certFiles, certDirectories []string
 
 // Creates a new *syscall.CertContext representing the leaf certificate in an in-memory
 // certificate store containing itself and all of the intermediate certificates specified
@@ -268,7 +268,12 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
 		}
 	}
 
+	chains = slices.DeleteFunc(chains, containsDistrustedSPKIHash)
+
 	if len(chains) == 0 {
+		if topErr == nil {
+			return nil, CertificateInvalidError{c, NoValidChains, ""}
+		}
 		// Return the error from the highest quality context.
 		return nil, topErr
 	}

package/bin/go/src/crypto/x509/verify.go

@@ -7,12 +7,15 @@ package x509
 import (
 	"bytes"
 	"crypto"
+	"crypto/sha256"
 	"crypto/x509/pkix"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"iter"
 	"maps"
 	"net"
+	"net/netip"
 	"runtime"
 	"slices"
 	"strings"
@@ -388,7 +391,12 @@ func parseRFC2821Mailbox(in string) (mailbox rfc2821Mailbox, ok bool) {
 	// The RFC species a format for domains, but that's known to be
 	// violated in practice so we accept that anything after an '@' is the
 	// domain part.
-	if _, ok := domainToReverseLabels(in); !ok {
+	if !domainNameValid(in, false) {
+		return mailbox, false
+	}
+
+	// Reject domain names containing @.
+	if strings.ContainsRune(in, '@') {
 		return mailbox, false
 	}
 
@@ -636,6 +644,9 @@ func (c *Certificate) Verify(opts VerifyOptions) ([][]*Certificate, error) {
 			}
 			return true
 		}
+		if containsDistrustedSPKIHash(chain) {
+			return true
+		}
 		return false
 	})
 
@@ -690,7 +701,7 @@ func alreadyInChain(candidate *Certificate, chain []*Certificate) bool {
 			continue
 		}
 		// We enforce the canonical encoding of SPKI (by only allowing the
-		// correct AI paremeter encodings in parseCertificate), so it's safe to
+		// correct AI parameter encodings in parseCertificate), so it's safe to
 		// directly compare the raw bytes.
 		if !bytes.Equal(candidate.RawSubjectPublicKeyInfo, cert.RawSubjectPublicKeyInfo) {
 			continue
@@ -939,15 +950,17 @@ func (c *Certificate) VerifyHostname(h string) error {
 	if len(h) >= 3 && h[0] == '[' && h[len(h)-1] == ']' {
 		candidateIP = h[1 : len(h)-1]
 	}
-	if ip := net.ParseIP(candidateIP); ip != nil {
+	// We use netip.ParseAddr() to allow IPv6 scoped addresses.
+	if addr, err := netip.ParseAddr(candidateIP); err == nil {
 		// We only match IP addresses against IP SANs.
 		// See RFC 6125, Appendix B.2.
+		ip := net.IP(addr.AsSlice())
 		for _, candidate := range c.IPAddresses {
 			if ip.Equal(candidate) {
 				return nil
 			}
 		}
-		return HostnameError{c, candidateIP}
+		return HostnameError{c, ip.String()}
 	}
 
 	candidateName := toLowerCaseASCII(h) // Save allocations inside the loop.
@@ -1397,3 +1410,29 @@ func policiesValid(chain []*Certificate, opts VerifyOptions) bool {
 
 	return true
 }
+
+// distrustedSPKIHashes contains hashes of SPKIs from certificates which
+// we don't consider to be trustworthy. We use these hashes to filter out
+// chains returned by Verify
+var distrustedSPKIHashes = map[string]struct{}{
+	"ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105": {},
+	"49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f": {},
+	"e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41": {},
+	"5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0": {},
+	"43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b": {},
+	"63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8": {},
+	"ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6": {},
+	"92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30": {},
+}
+
+// containsDistrustedSPKIHash checks if any of the certificates in the chain
+// have an SPKI whose hash is present in the distrustedSPKIHashes map.
+func containsDistrustedSPKIHash(chain []*Certificate) bool {
+	for _, c := range chain {
+		h := sha256.Sum256(c.RawSubjectPublicKeyInfo)
+		if _, ok := distrustedSPKIHashes[hex.EncodeToString(h[:])]; ok {
+			return true
+		}
+	}
+	return false
+}

package/bin/go/src/crypto/x509/x509.go

@@ -27,6 +27,8 @@ import (
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
+	"crypto/fips140"
+	"crypto/mldsa"
 	"crypto/rsa"
 	"crypto/sha1"
 	"crypto/sha256"
@@ -65,8 +67,8 @@ type pkixPublicKey struct {
 // public key is a SubjectPublicKeyInfo structure (see RFC 5280, Section 4.1).
 //
 // It returns a *[rsa.PublicKey], *[dsa.PublicKey], *[ecdsa.PublicKey],
-// [ed25519.PublicKey] (not a pointer), or *[ecdh.PublicKey] (for X25519).
-// More types might be supported in the future.
+// [ed25519.PublicKey] (not a pointer), *[mldsa.PublicKey], or *[ecdh.PublicKey]
+// (for X25519). More types might be supported in the future.
 //
 // This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
 func ParsePKIXPublicKey(derBytes []byte) (pub any, err error) {
@@ -115,6 +117,13 @@ func marshalPublicKey(pub any) (publicKeyBytes []byte, publicKeyAlgorithm pkix.A
 	case ed25519.PublicKey:
 		publicKeyBytes = pub
 		publicKeyAlgorithm.Algorithm = oidPublicKeyEd25519
+	case *mldsa.PublicKey:
+		oid, ok := oidFromMLDSAParameters(pub.Parameters())
+		if !ok {
+			return nil, pkix.AlgorithmIdentifier{}, errors.New("x509: unsupported ML-DSA parameters")
+		}
+		publicKeyBytes = pub.Bytes()
+		publicKeyAlgorithm.Algorithm = oid
 	case *ecdh.PublicKey:
 		publicKeyBytes = pub.Bytes()
 		if pub.Curve() == ecdh.X25519() {
@@ -144,8 +153,8 @@ func marshalPublicKey(pub any) (publicKeyBytes []byte, publicKeyAlgorithm pkix.A
 // (see RFC 5280, Section 4.1).
 //
 // The following key types are currently supported: *[rsa.PublicKey],
-// *[ecdsa.PublicKey], [ed25519.PublicKey] (not a pointer), and *[ecdh.PublicKey].
-// Unsupported key types result in an error.
+// *[ecdsa.PublicKey], [ed25519.PublicKey] (not a pointer), *[mldsa.PublicKey],
+// and *[ecdh.PublicKey]. Unsupported key types result in an error.
 //
 // This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
 func MarshalPKIXPublicKey(pub any) ([]byte, error) {
@@ -231,6 +240,9 @@ const (
 	SHA384WithRSAPSS
 	SHA512WithRSAPSS
 	PureEd25519
+	MLDSA44
+	MLDSA65
+	MLDSA87
 )
 
 func (algo SignatureAlgorithm) isRSAPSS() bool {
@@ -268,6 +280,7 @@ const (
 	DSA // Only supported for parsing.
 	ECDSA
 	Ed25519
+	MLDSA
 )
 
 var publicKeyAlgoName = [...]string{
@@ -275,6 +288,7 @@ var publicKeyAlgoName = [...]string{
 	DSA:     "DSA",
 	ECDSA:   "ECDSA",
 	Ed25519: "Ed25519",
+	MLDSA:   "ML-DSA",
 }
 
 func (algo PublicKeyAlgorithm) String() string {
@@ -384,6 +398,9 @@ var signatureAlgorithmDetails = []struct {
 	{ECDSAWithSHA384, "ECDSA-SHA384", oidSignatureECDSAWithSHA384, emptyRawValue, ECDSA, crypto.SHA384, false},
 	{ECDSAWithSHA512, "ECDSA-SHA512", oidSignatureECDSAWithSHA512, emptyRawValue, ECDSA, crypto.SHA512, false},
 	{PureEd25519, "Ed25519", oidSignatureEd25519, emptyRawValue, Ed25519, crypto.Hash(0) /* no pre-hashing */, false},
+	{MLDSA44, "ML-DSA-44", oidPublicKeyMLDSA44, emptyRawValue, MLDSA, crypto.Hash(0) /* no pre-hashing */, false},
+	{MLDSA65, "ML-DSA-65", oidPublicKeyMLDSA65, emptyRawValue, MLDSA, crypto.Hash(0) /* no pre-hashing */, false},
+	{MLDSA87, "ML-DSA-87", oidPublicKeyMLDSA87, emptyRawValue, MLDSA, crypto.Hash(0) /* no pre-hashing */, false},
 }
 
 var emptyRawValue = asn1.RawValue{}
@@ -414,9 +431,14 @@ type pssParameters struct {
 }
 
 func getSignatureAlgorithmFromAI(ai pkix.AlgorithmIdentifier) SignatureAlgorithm {
-	if ai.Algorithm.Equal(oidSignatureEd25519) {
+	if ai.Algorithm.Equal(oidSignatureEd25519) ||
+		ai.Algorithm.Equal(oidPublicKeyMLDSA44) ||
+		ai.Algorithm.Equal(oidPublicKeyMLDSA65) ||
+		ai.Algorithm.Equal(oidPublicKeyMLDSA87) {
 		// RFC 8410, Section 3
 		// > For all of the OIDs, the parameters MUST be absent.
+		// RFC 9881, Section 2
+		// > The contents of the parameters component for each algorithm MUST be absent.
 		if len(ai.Parameters.FullBytes) != 0 {
 			return UnknownSignatureAlgorithm
 		}
@@ -492,6 +514,22 @@ var (
 	//	id-Ed25519   OBJECT IDENTIFIER ::= { 1 3 101 112 }
 	oidPublicKeyX25519  = asn1.ObjectIdentifier{1, 3, 101, 110}
 	oidPublicKeyEd25519 = asn1.ObjectIdentifier{1, 3, 101, 112}
+	// RFC 9881, Section 2
+	//
+	//	id-ml-dsa-44 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
+	//		country(16) us(840) organization(1) gov(101) csor(3)
+	//		nistAlgorithm(4) sigAlgs(3) id-ml-dsa-44(17) }
+	//
+	//	id-ml-dsa-65 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
+	//		country(16) us(840) organization(1) gov(101) csor(3)
+	//		nistAlgorithm(4) sigAlgs(3) id-ml-dsa-65(18) }
+	//
+	//	id-ml-dsa-87 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
+	//		country(16) us(840) organization(1) gov(101) csor(3)
+	//		nistAlgorithm(4) sigAlgs(3) id-ml-dsa-87(19) }
+	oidPublicKeyMLDSA44 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 17}
+	oidPublicKeyMLDSA65 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 18}
+	oidPublicKeyMLDSA87 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 19}
 )
 
 // getPublicKeyAlgorithmFromOID returns the exposed PublicKeyAlgorithm
@@ -507,6 +545,14 @@ func getPublicKeyAlgorithmFromOID(oid asn1.ObjectIdentifier) PublicKeyAlgorithm
 		return ECDSA
 	case oid.Equal(oidPublicKeyEd25519):
 		return Ed25519
+	case oid.Equal(oidPublicKeyMLDSA44),
+		oid.Equal(oidPublicKeyMLDSA65),
+		oid.Equal(oidPublicKeyMLDSA87):
+		// ML-DSA is not available in FIPS 140-3 module v1.0.0.
+		if fips140.Version() == "v1.0.0" {
+			return UnknownPublicKeyAlgorithm
+		}
+		return MLDSA
 	}
 	return UnknownPublicKeyAlgorithm
 }
@@ -578,6 +624,30 @@ func oidFromECDHCurve(curve ecdh.Curve) (asn1.ObjectIdentifier, bool) {
 	return nil, false
 }
 
+func mldsaParametersFromOID(oid asn1.ObjectIdentifier) (mldsa.Parameters, bool) {
+	switch {
+	case oid.Equal(oidPublicKeyMLDSA44):
+		return mldsa.MLDSA44(), true
+	case oid.Equal(oidPublicKeyMLDSA65):
+		return mldsa.MLDSA65(), true
+	case oid.Equal(oidPublicKeyMLDSA87):
+		return mldsa.MLDSA87(), true
+	}
+	return mldsa.Parameters{}, false
+}
+
+func oidFromMLDSAParameters(params mldsa.Parameters) (asn1.ObjectIdentifier, bool) {
+	switch {
+	case params == mldsa.MLDSA44():
+		return oidPublicKeyMLDSA44, true
+	case params == mldsa.MLDSA65():
+		return oidPublicKeyMLDSA65, true
+	case params == mldsa.MLDSA87():
+		return oidPublicKeyMLDSA87, true
+	}
+	return nil, false
+}
+
 // KeyUsage represents the set of actions that are valid for a given key. It's
 // a bitmap of the KeyUsage* constants.
 type KeyUsage int
@@ -707,6 +777,7 @@ type Certificate struct {
 	RawSubjectPublicKeyInfo []byte // DER encoded SubjectPublicKeyInfo.
 	RawSubject              []byte // DER encoded Subject
 	RawIssuer               []byte // DER encoded Issuer
+	RawSignatureAlgorithm   []byte // DER encoded AlgorithmIdentifier
 
 	Signature          []byte
 	SignatureAlgorithm SignatureAlgorithm
@@ -975,6 +1046,10 @@ func signaturePublicKeyAlgoMismatchError(expectedPubKeyAlgo PublicKeyAlgorithm,
 	return fmt.Errorf("x509: signature algorithm specifies an %s public key, but have public key of type %T", expectedPubKeyAlgo.String(), pubKey)
 }
 
+func signatureMLDSAParametersMismatchError(expectedSigAlgo SignatureAlgorithm, pubKey *mldsa.PublicKey) error {
+	return fmt.Errorf("x509: signature algorithm specifies an ML-DSA public key with %s parameters, but have a public key with %s parameters", expectedSigAlgo, pubKey.Parameters())
+}
+
 // checkSignature verifies that signature is a valid signature over signed from
 // a crypto.PublicKey.
 func checkSignature(algo SignatureAlgorithm, signed, signature []byte, publicKey crypto.PublicKey, allowSHA1 bool) (err error) {
@@ -991,7 +1066,7 @@ func checkSignature(algo SignatureAlgorithm, signed, signature []byte, publicKey
 
 	switch hashType {
 	case crypto.Hash(0):
-		if pubKeyAlgo != Ed25519 {
+		if pubKeyAlgo != Ed25519 && pubKeyAlgo != MLDSA {
 			return ErrUnsupportedAlgorithm
 		}
 	case crypto.MD5:
@@ -1037,6 +1112,30 @@ func checkSignature(algo SignatureAlgorithm, signed, signature []byte, publicKey
 			return errors.New("x509: Ed25519 verification failure")
 		}
 		return
+	case *mldsa.PublicKey:
+		if pubKeyAlgo != MLDSA {
+			return signaturePublicKeyAlgoMismatchError(pubKeyAlgo, pub)
+		}
+		switch pub.Parameters() {
+		case mldsa.MLDSA44():
+			if algo != MLDSA44 {
+				return signatureMLDSAParametersMismatchError(algo, pub)
+			}
+		case mldsa.MLDSA65():
+			if algo != MLDSA65 {
+				return signatureMLDSAParametersMismatchError(algo, pub)
+			}
+		case mldsa.MLDSA87():
+			if algo != MLDSA87 {
+				return signatureMLDSAParametersMismatchError(algo, pub)
+			}
+		default:
+			return fmt.Errorf("x509: unknown ML-DSA parameters: %s", pub.Parameters())
+		}
+		if err := mldsa.Verify(pub, signed, signature, nil); err != nil {
+			return fmt.Errorf("x509: ML-DSA verification failure: %w", err)
+		}
+		return
 	}
 	return ErrUnsupportedAlgorithm
 }
@@ -1299,12 +1398,17 @@ func buildCertExtensions(template *Certificate, subjectIsEmpty bool, authorityKe
 		ret[n].Id = oidExtensionNameConstraints
 		ret[n].Critical = template.PermittedDNSDomainsCritical
 
-		ipAndMask := func(ipNet *net.IPNet) []byte {
+		ipAndMask := func(ipNet *net.IPNet) ([]byte, error) {
 			maskedIP := ipNet.IP.Mask(ipNet.Mask)
+			// This is extremely unlikely to actually happen, but lets save people from doing something they
+			// probably shouldn't.
+			if len(maskedIP) == net.IPv6len && maskedIP.To4() != nil {
+				return nil, errors.New("x509: IP constraint contained IPv4-mapped IPv6 address with a IPv6 mask")
+			}
 			ipAndMask := make([]byte, 0, len(maskedIP)+len(ipNet.Mask))
 			ipAndMask = append(ipAndMask, maskedIP...)
 			ipAndMask = append(ipAndMask, ipNet.Mask...)
-			return ipAndMask
+			return ipAndMask, nil
 		}
 
 		serialiseConstraints := func(dns []string, ips []*net.IPNet, emails []string, uriDomains []string) (der []byte, err error) {
@@ -1323,9 +1427,13 @@ func buildCertExtensions(template *Certificate, subjectIsEmpty bool, authorityKe
 			}
 
 			for _, ipNet := range ips {
+				encodedIPNet, err := ipAndMask(ipNet)
+				if err != nil {
+					return nil, err
+				}
 				b.AddASN1(cryptobyte_asn1.SEQUENCE, func(b *cryptobyte.Builder) {
 					b.AddASN1(cryptobyte_asn1.Tag(7).ContextSpecific(), func(b *cryptobyte.Builder) {
-						b.AddBytes(ipAndMask(ipNet))
+						b.AddBytes(encodedIPNet)
 					})
 				})
 			}
@@ -1558,8 +1666,21 @@ func signingParamsForKey(key crypto.Signer, sigAlgo SignatureAlgorithm) (Signatu
 		pubType = Ed25519
 		defaultAlgo = PureEd25519
 
+	case *mldsa.PublicKey:
+		pubType = MLDSA
+		switch pub.Parameters() {
+		case mldsa.MLDSA44():
+			defaultAlgo = MLDSA44
+		case mldsa.MLDSA65():
+			defaultAlgo = MLDSA65
+		case mldsa.MLDSA87():
+			defaultAlgo = MLDSA87
+		default:
+			return 0, ai, fmt.Errorf("x509: unsupported ML-DSA parameters: %s", pub.Parameters())
+		}
+
 	default:
-		return 0, ai, errors.New("x509: only RSA, ECDSA and Ed25519 keys supported")
+		return 0, ai, errors.New("x509: only RSA, ECDSA, ML-DSA and Ed25519 keys supported")
 	}
 
 	if sigAlgo == 0 {
@@ -1571,6 +1692,9 @@ func signingParamsForKey(key crypto.Signer, sigAlgo SignatureAlgorithm) (Signatu
 			if details.pubKeyAlgo != pubType {
 				return 0, ai, errors.New("x509: requested SignatureAlgorithm does not match private key type")
 			}
+			if pubType == MLDSA && sigAlgo != defaultAlgo {
+				return 0, ai, errors.New("x509: requested SignatureAlgorithm does not match ML-DSA parameters")
+			}
 			if details.hash == crypto.MD5 {
 				return 0, ai, errors.New("x509: signing with MD5 is not supported")
 			}
@@ -1656,9 +1780,10 @@ var emptyASN1Subject = []byte{0x30, 0}
 //
 // The returned slice is the certificate in DER encoding.
 //
-// The currently supported key types are *rsa.PublicKey, *ecdsa.PublicKey and
-// ed25519.PublicKey. pub must be a supported key type, and priv must be a
-// crypto.Signer or crypto.MessageSigner with a supported public key.
+// The currently supported key types are *rsa.PublicKey, *ecdsa.PublicKey,
+// ed25519.PublicKey, and *mldsa.PublicKey. pub must be a supported key type,
+// and priv must be a crypto.Signer or crypto.MessageSigner with a supported
+// public key.
 //
 // The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
 // unless the resulting certificate is self-signed. Otherwise the value from
@@ -1676,6 +1801,9 @@ var emptyASN1Subject = []byte{0x30, 0}
 // be marshaled instead of the Policies field. This changed in Go 1.24. The Policies field can
 // be used to marshal policy OIDs which have components that are larger than 31
 // bits.
+//
+// IP addresses in IPAddresses which are in their IPv4-mapped IPv6 form will always be encoded
+// in their IPv4 form.
 func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv any) ([]byte, error) {
 	key, ok := priv.(crypto.Signer)
 	if !ok {
@@ -1914,6 +2042,7 @@ type CertificateRequest struct {
 	RawTBSCertificateRequest []byte // Certificate request info part of raw ASN.1 DER content.
 	RawSubjectPublicKeyInfo  []byte // DER encoded SubjectPublicKeyInfo.
 	RawSubject               []byte // DER encoded Subject.
+	RawSignatureAlgorithm    []byte // DER encoded AlgorithmIdentifier.
 
 	Version            int
 	Signature          []byte
@@ -1966,8 +2095,12 @@ type tbsCertificateRequest struct {
 type certificateRequest struct {
 	Raw                asn1.RawContent
 	TBSCSR             tbsCertificateRequest
-	SignatureAlgorithm pkix.AlgorithmIdentifier
-	SignatureValue     asn1.BitString
+	SignatureAlgorithm struct {
+		Raw        asn1.RawContent
+		Algorithm  asn1.ObjectIdentifier
+		Parameters asn1.RawValue `asn1:"optional"`
+	}
+	SignatureValue asn1.BitString
 }
 
 // oidExtensionRequest is a PKCS #9 OBJECT IDENTIFIER that indicates requested
@@ -2061,8 +2194,9 @@ func parseCSRExtensions(rawAttributes []asn1.RawValue) ([]pkix.Extension, error)
 // priv is the private key to sign the CSR with, and the corresponding public
 // key will be included in the CSR. It must implement crypto.Signer or
 // crypto.MessageSigner and its Public() method must return a *rsa.PublicKey or
-// a *ecdsa.PublicKey or a ed25519.PublicKey. (A *rsa.PrivateKey,
-// *ecdsa.PrivateKey or ed25519.PrivateKey satisfies this.)
+// a *ecdsa.PublicKey or a ed25519.PublicKey or a *mldsa.PublicKey.
+// (A *rsa.PrivateKey, *ecdsa.PrivateKey or ed25519.PrivateKey or
+// *mldsa.PrivateKey satisfies this.)
 //
 // The returned slice is the certificate request in DER encoding.
 func CreateCertificateRequest(rand io.Reader, template *CertificateRequest, priv any) (csr []byte, err error) {
@@ -2202,11 +2336,12 @@ func CreateCertificateRequest(rand io.Reader, template *CertificateRequest, priv
 		return nil, err
 	}
 
-	return asn1.Marshal(certificateRequest{
-		TBSCSR:             tbsCSR,
-		SignatureAlgorithm: algorithmIdentifier,
-		SignatureValue:     asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
-	})
+	cr := certificateRequest{}
+	cr.TBSCSR = tbsCSR
+	cr.SignatureAlgorithm.Algorithm = algorithmIdentifier.Algorithm
+	cr.SignatureAlgorithm.Parameters = algorithmIdentifier.Parameters
+	cr.SignatureValue = asn1.BitString{Bytes: signature, BitLength: len(signature) * 8}
+	return asn1.Marshal(cr)
 }
 
 // ParseCertificateRequest parses a single certificate request from the
@@ -2230,9 +2365,13 @@ func parseCertificateRequest(in *certificateRequest) (*CertificateRequest, error
 		RawTBSCertificateRequest: in.TBSCSR.Raw,
 		RawSubjectPublicKeyInfo:  in.TBSCSR.PublicKey.Raw,
 		RawSubject:               in.TBSCSR.Subject.FullBytes,
+		RawSignatureAlgorithm:    in.SignatureAlgorithm.Raw,
 
-		Signature:          in.SignatureValue.RightAlign(),
-		SignatureAlgorithm: getSignatureAlgorithmFromAI(in.SignatureAlgorithm),
+		Signature: in.SignatureValue.RightAlign(),
+		SignatureAlgorithm: getSignatureAlgorithmFromAI(pkix.AlgorithmIdentifier{
+			Algorithm:  in.SignatureAlgorithm.Algorithm,
+			Parameters: in.SignatureAlgorithm.Parameters,
+		}),
 
 		PublicKeyAlgorithm: getPublicKeyAlgorithmFromOID(in.TBSCSR.PublicKey.Algorithm.Algorithm),
 
@@ -2248,14 +2387,11 @@ func parseCertificateRequest(in *certificateRequest) (*CertificateRequest, error
 		}
 	}
 
-	var subject pkix.RDNSequence
-	if rest, err := asn1.Unmarshal(in.TBSCSR.Subject.FullBytes, &subject); err != nil {
+	subject, err := parseName(in.TBSCSR.Subject.FullBytes)
+	if err != nil {
 		return nil, err
-	} else if len(rest) != 0 {
-		return nil, errors.New("x509: trailing data after X.509 Subject")
 	}
-
-	out.Subject.FillFromRDNSequence(&subject)
+	out.Subject.FillFromRDNSequence(subject)
 
 	if out.Extensions, err = parseCSRExtensions(in.TBSCSR.RawAttributes); err != nil {
 		return nil, err
@@ -2327,6 +2463,9 @@ type RevocationList struct {
 	RawTBSRevocationList []byte
 	// RawIssuer contains the DER encoded Issuer.
 	RawIssuer []byte
+	// RawSignatureAlgorithm contains the DER encoded signature algorithm as a
+	// PKIX AlgorithmIdentifier.
+	RawSignatureAlgorithm []byte
 
 	// Issuer contains the DN of the issuing certificate.
 	Issuer pkix.Name