Security patch

[droren]

Key fixes:

• certstore/certstore_linux.go no longer passes the PKCS#12 password on the openssl command line. The fallback now uses -passin fd:3, so the password is not exposed via /proc or ps.
• command_verify.go no longer auto-trusts local signing certs as roots by default. That behavior is now explicit opt-in via --trust-local-certs or SMIMESIGN_TRUST_LOCAL_CERTS=1.
• command_verify.go also tightened EKU defaults to emailProtection and codeSigning, with explicit compatibility opt-in via --allow-any-eku or SMIMESIGN_ALLOW_ANY_EKU=1.
• revocation.go adds optional OCSP revocation checking, enabled with --revocation-check=ocsp or SMIMESIGN_REVOCATION_CHECK=ocsp.
• ietf-cms/timestamp/timestamp.go now requires HTTPS TSA URLs by default, with an explicit SMIMESIGN_ALLOW_HTTP_TSA=1 escape hatch for controlled environments.
• certstore/certstore_windows.go fixes the Windows provider-parameter leak by returning Go-managed memory instead of C.CBytes.
• utils.go now uses SHA-256 as the default fingerprint, still accepts exact legacy SHA-1 fingerprints for compatibility, and rejects very short partial matches.
• cmd/git-x509-cert/main.go no longer emits SHA-1 fingerprints in its fallback dump.
• go.mod is updated to toolchain go1.25.8, and gocertifi was updated to the latest available version for this dependency line.

Audit flow:

• Makefile now has make audit-tools and make audit.
• .github/workflows/security-audit.yml adds CI for that flow.
• README.md now documents the new verification controls, audit commands, and uses fictional certificate IDs instead of real ones.

Verification:

• go test ./... passed.
• make audit passed end to end after switching govulncheck to binary mode to avoid the source-mode analyzer bug on this toolchain.
• No real-name, real-email, or real-fingerprint references were found in the repo content I searched.

Residual risk:

• Revocation checking is now optional OCSP only. CRL support is still not implemented.
• Existing installs/releases will not pick up any of this until you rebuild and republish.
• Untracked local artifacts remain: build/audit/, build/tools/, and cert.crt.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f085f6516

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[droren]

Verified.