Change Log

v0.14.0 (2022-06-13)

Retry failed log requests. This should make certspotter resilient to rate limiting by logs.
Add -version flag.
Eliminate unnecessary dependency. certspotter now depends only on golang.org/x packages.
Switch to Go modules.

Add support for contacting logs via HTTP proxies; just set the appropriate environment variable as documented at https://golang.org/pkg/net/http/#ProxyFromEnvironment.
Work around RFC 6962 ambiguity related to consistency proofs for empty trees.

Improve speed by processing logs in parallel
Add -start_at_end option to begin monitoring new logs at the end, which significantly speeds up Cert Spotter, at the cost of missing certificates that were added to a log before Cert Spotter starts monitoring it
(Behavior change) Scan logs in their entirety the first time Cert Spotter is run, unless -start_at_end specified (behavior change)
The log list is now retrieved from certspotter.org at startup instead of being embedded in the source. This will allow Cert Spotter to react more quickly to the frequent changes in logs.
(Behavior change) the -logs option now expects a JSON file in the v2 log list format. See https://www.certificate-transparency.org/known-logs and https://www.gstatic.com/ct/log_list/v2/log_list_schema.json.
-logs now accepts an HTTPS URL in addition to a file path.
(Behavior change) the -underwater option has been removed. If you want its behavior, specify https://loglist.certspotter.org/underwater.json to the -logs option.

Add Cloudflare Nimbus logs
Remove Google Argon 2017 log
Remove WoSign and StartCom logs due to disqualification by Chromium and extended downtime

Remove PuChuangSiDa 1 log due to excessive downtime and presumptive disqualification from Chrome
Add Venafi Gen2 log
Improve monitoring robustness under certain pathological behavior by logs
Minor documentation improvements

Revise -all_time flag (behavior change):
- If -all_time is specified, scan the entirety of all logs, even existing logs
- When a new log is added, scan it in its entirety even if -all_time is not specified
Add new logs:
- Google Icarus
- Google Skydiver
- StartCom
- WoSign
Overhaul log processing and auditing logic:
- STHs are never deleted unless they can be verified
- Multiple unverified STHs can be queued per log, laying groundwork for STH pollination support
- New state directory layout; current state directories will be migrated, but migration will be removed in a future version
- Persist condensed Merkle Tree state between runs, instead of reconstructing it from consistency proof every time
Use a lock file to prevent multiple instances of Cert Spotter from running concurrently (which could clobber the state directory).
Minor bug fixes and improvements