Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.3-rc2_amd64.tar.gz
• 📦 step-ca_0.28.3.rc2-1_amd64.deb
• 📦 step-ca-0.28.3.rc2-1.x86_64.rpm
• 📦 step-ca_0.28.3.rc2-1_arm64.deb
• 📦 step-ca-0.28.3.rc2-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.3-rc2_amd64.tar.gz
• 📦 step-ca_darwin_0.28.3-rc2_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.3-rc2_amd64.zip

For more builds across platforms and architectures, see the Assets section below. And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.3-rc2_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.28.3-rc2_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.3-rc2_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 312d1a2f9282bf447baa198eba9bb6530f724cb9 Merge pull request #2325 from smallstep/mariano/httpclient
• 244e61098684e218bf93674d11a04247dd5385b8 Merge pull request #2326 from smallstep/mariano/fix-2323
• 1ae78b803deb7afae4b98dd7507040593a0a1ea6 Make poolhttp thread safe.
• 2b13b82ee371a6a0493c2fd935295a268919a940 Apply suggestions from code review
• d647ba3e9cf115e3bd7a12b9485ab0bd93a9d533 Allow to specify audience when generating JWK provisioner tokens
• b690e1214d9526ebede6a3d6bd2b75a2aa7d9616 Remove commented code
• f3c2e94576b949e3476938483c6bf3234a135841 Address linter errors
• d4fd467e8ae3ab0b7e3e03e6c94df0e5fbd76691 Memory improvements
• a1067cab464d3a9cc17a8acfab6887821525ba6f Merge pull request #2324 from smallstep/dependabot/go_modules/google.golang.org/api-0.239.0
• 8c66606300bd627c68dfab4277d4a8afd341dec5 Bump google.golang.org/api from 0.238.0 to 0.239.0
• 46b1c4c124ce3e41f6a1a4ededa8b32cdd5d4173 Merge pull request #2315 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.67.0
• 7fcdbac351f61f21aef3cf9baddc527e475d2dc3 Bump go.step.sm/crypto from 0.66.0 to 0.67.0
• cea37d4a3126f8be49540cae06320fa688ad7ec7 Merge pull request #2316 from smallstep/dependabot/go_modules/google.golang.org/api-0.238.0
• aea6f93f5bfdbe2a7d0bb10a6a3b80442c0895c1 Bump google.golang.org/api from 0.236.0 to 0.238.0
• f8f2768283a5f8d9726bcf201af166a678e01205 Merge pull request #2317 from smallstep/dependabot/go_modules/golang.org/x/net-0.41.0
• 3e449b8e5c17535a6fb1bcf377143d37db415eac Merge pull request #2314 from smallstep/dependabot/go_modules/github.com/urfave/cli-1.22.17
• eb8a1269fc28eea85a13f13e476b5ab82ce8431e Bump golang.org/x/net from 0.40.0 to 0.41.0
• ef3684c32b545a7b8213cfec510630488e9ae3ac Bump github.com/urfave/cli from 1.22.16 to 1.22.17
• c6902d1a091c1bdab867391ee41bac517a557894 Merge pull request #2313 from smallstep/dependabot/go_modules/github.com/go-chi/chi/v5-5.2.2
• 7ada4cdde4216ed9d01c4d5d91e315adb847d568 Bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2
• 915767b5973de6551e88a9f36c02a6dff22a71d3 Merge pull request #2309 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.3.2
• 60faccdf6cd4fe0d7a4e82d02867c71297339424 Bump softprops/action-gh-release from 2.2.2 to 2.3.2
• 0603831d838361205a9416f3166fede3b2901088 Merge pull request #2294 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.39.0
• e2f06c12a4d06ec058a0b1229b4a3f2b74137fde Merge branch 'master' into dependabot/go_modules/golang.org/x/crypto-0.39.0
• d9aaa751fb58bbc787ecbeafe95468014090b92b Merge pull request #2300 from smallstep/mariano/sans
• c4f2b365396b7de047834c2a21195f6a742f19f0 Add the certificate sans to the logs
• 5c2059ac13f5f11baf54050a6214b71f7a83ea03 Ignore ssh.InsecureKeyAlgoDSA usage from staticcheck linter
• ac2f214a5d85d2ef0e9d42ce91609c14724f5e5e Merge pull request #2293 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/aws-0.10.0
• df7fa4129c56c959e418d7c77101f18186392f0c Bump golang.org/x/crypto from 0.38.0 to 0.39.0
• 547322f3aff0c59fcf44b84d8ff4ab0b46a586b2 Bump github.com/hashicorp/vault/api/auth/aws from 0.9.0 to 0.10.0
• 437dc1fe3601b4ba97a576913c88a17789219bec Merge pull request #2298 from smallstep/dependabot/go_modules/google.golang.org/api-0.236.0
• 66a32d24362c0f985d4a65c01cf8cbe41410700b Merge pull request #2299 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/approle-0.10.0
• ba5a7ffba24dd22e5f1bdba7eeaeeee1b065efb6 Bump github.com/hashicorp/vault/api/auth/approle from 0.9.0 to 0.10.0
• 247733da34ae428c34edaacaf417bcd984b187bd Bump google.golang.org/api from 0.235.0 to 0.236.0
• e8c9c98403b54c86e804d81712644f8df1061c36 Merge pull request #2297 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/kubernetes-0.10.0
• 909700f71a433cbf19c9c3cad67da5a45aaa28de Bump github.com/hashicorp/vault/api/auth/kubernetes from 0.9.0 to 0.10.0
• 3efe7eebb5ff5c71cd4b47fe6da50b9a217f8203 Merge pull request #2295 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.73.0
• 675e2a5a2e9eba83cd69b6f2ae5e254d88cf29a6 Merge pull request #2296 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api-1.20.0
• 37899f0a6bef9c19c5f7f78d4974e342bee6ffa1 Bump github.com/hashicorp/vault/api from 1.16.0 to 1.20.0
• a97d348f47873d633f2c6a26a98fcaaeebca1214 Bump google.golang.org/grpc from 1.72.2 to 1.73.0
• a7b4e75e3e1a2a9aba126c06cc1040880f72ae58 Merge pull request #2290 from smallstep/mariano/metrics
• c26c8d7615372978c96d5c76e8071b59997bdca9 Add SSH certificate type to metrics
• 4f5c524606cb370b33708b175d652aa6dad4de8e Merge pull request #2287 from smallstep/dependabot/go_modules/google.golang.org/api-0.235.0
• 300703916ee9e93b40d20a8e7f942291b2c4ef6f Bump google.golang.org/api from 0.234.0 to 0.235.0
• 1a333945746d6d48528113d10b3cf4fd75024148 Merge pull request #2286 from smallstep/mariano/csr-templates
• 332aa4b39d3532160484bc9be8ca8b4a4dedd668 Fix unit tests
• 35bade124619fd8f759817bb763ff0fe7bd82598 Update go.step.sm/crypto with template improvements
• b0c479a0764ef1eb5c4299d8d0e08d37d62c5059 Merge pull request #2283 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.72.2
• 3cf968822644f14d7b1c98982bdc016631d16ffb Bump google.golang.org/grpc from 1.72.1 to 1.72.2
• 1949cb02c45bdae737a9a602960dc291caae388c Merge pull request #2282 from smallstep/dependabot/go_modules/google.golang.org/api-0.234.0
• ed9c0d5e120c961a8f85e647dff467606f68104d Merge pull request #2281 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.64.0
• b3b1c939630bb33d1dc1b42ae3fd70cdfd8d425f Bump google.golang.org/api from 0.233.0 to 0.234.0
• b22130a48cd84ab638a1f7fe7c11b98d0ad40ac7 Bump go.step.sm/crypto from 0.63.0 to 0.64.0
• 0b0f3519b27c47b4439648be3abffc10a90c5d6e Merge pull request #2277 from smallstep/herman/golangci-lint-v2-and-upgrades
• dd80264006b724cd42172933cb2b4cc70679635f Upgrade github.com/googleapis/gax-go/v2 to v2.14.2
• 2d03c70aa41e7be66f736db3111802618bf9bcdd Upgrade google.golang.org/grpc to v1.72.1
• acf4387180f745702cd8a2ad79012ba6f3edc930 Fix new golangci-lint v2 linter issues
• 3367a61bcc2ff234c191e6729d6e30485be9246f Bump google.golang.org/api from 0.232.0 to 0.233.0
• 30e79a2b80c8ab9aecb9d98972812c8a5ffc0a26 Merge pull request #2265 from smallstep/dependabot/go_modules/golang.org/x/net-0.40.0
• cde1e01a284be5380314cae8f3485350558e19f8 Bump golang.org/x/net from 0.39.0 to 0.40.0
• c3fddeb61bd4eb764233a2f5574f8fa9a1d057a5 Merge pull request #2266 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.38.0
• f6f215110996925f560e09035439b1ea5ad78f38 Bump golang.org/x/crypto from 0.37.0 to 0.38.0
• 2b28391298517b6e737ef4128386bbf7b5aee65a Merge pull request #2267 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.39.0
• 277cdcc44b0f7e21f82cea4418752412337eae4e Merge pull request #2269 from smallstep/dependabot/go_modules/google.golang.org/api-0.232.0
• 938a4da5adf2d32f36ffd06922e5c66956dfff41 Merge pull request #2268 from smallstep/dependabot/go_modules/github.com/google/go-tpm-0.9.5
• 05944ad4f006131db43bed2e25d75379e8917707 Bump google.golang.org/api from 0.231.0 to 0.232.0
• 19f3ad9bcede7a202142c0555fd6adeb9aaa0f8c Bump github.com/google/go-tpm from 0.9.4 to 0.9.5
• 6a9345aa72136fa144711e27e622cab93a1d5ef8 Bump github.com/newrelic/go-agent/v3 from 3.38.0 to 3.39.0
• 10933e343b8ac4e3780944d99e86b5b975defc31 Merge pull request #2257 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.63.0
• b21c3071ceec3e78302111c6531593d3da2f90e1 Bump go.step.sm/crypto from 0.61.0 to 0.63.0
• 9e735b285da16cc3854622af1198844059e1bb4a Merge pull request #2258 from smallstep/dependabot/go_modules/go.uber.org/mock-0.5.2
• e9b9bcb7866776266c4720192baede79adec254a Merge pull request #2259 from smallstep/dependabot/go_modules/github.com/google/go-tpm-0.9.4
• 33d85534df18eb0dbb2779b928296140bc56a3a5 Merge pull request #2256 from smallstep/dependabot/go_modules/google.golang.org/api-0.231.0
• d33f35c1f8b60786996576d4732c08c663267456 Bump github.com/google/go-tpm from 0.9.3 to 0.9.4
• 5762a91d3ef51cd363f26414e5c7a2d066c4d104 Bump go.uber.org/mock from 0.5.1 to 0.5.2
• e6d4f4d563125e8cf4294a019d1bb97cdff93939 Bump google.golang.org/api from 0.230.0 to 0.231.0
• 78cb7cc5cfbec91b2a3a6c7d8b8087ea3f901c9c Merge pull request #2252 from smallstep/dependabot/go_modules/google.golang.org/api-0.230.0
• 99745581388774c844a445745c2ba6331e761e3a Bump google.golang.org/api from 0.229.0 to 0.230.0
• 4b7e539ee2e3f3049ccffdbe20886164282869a1 Merge pull request #2249 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.61.0
• bde672cdd9268094d4442d820aea0cdfb190868a Merge pull request #2245 from smallstep/dependabot/go_modules/cloud.google.com/go/longrunning-0.6.7
• 0303970820efa3c5ebe161d5b32c8d0a6160ba9e Bump go.step.sm/crypto from 0.60.0 to 0.61.0
• ea54eee46bc5df15be015dc2cec44b518c2ae143 Bump cloud.google.com/go/longrunning from 0.6.6 to 0.6.7
• 4fa1a8413ae7eced2764c237fbc37af3ad72230f Merge pull request #2246 from smallstep/dependabot/go_modules/cloud.google.com/go/security-1.18.5
• de075045d06af25e92e07dab9bf8758800c80884 Bump cloud.google.com/go/security from 1.18.4 to 1.18.5
• 92cb7a8a33e92cf2beb711a797df86afeb3e52a5 Merge pull request #2248 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.72.0
• e3363888f4c2c1e1c24aafd06f695479553e32c1 Merge pull request #2244 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.2.2
• a6d2de532de5fe883b2ba039a03e87c558132f85 Bump google.golang.org/grpc from 1.71.1 to 1.72.0
• d61c3d99719aea85c18911ae405b864609666537 Bump softprops/action-gh-release from 2.2.1 to 2.2.2
• 0103877b17b4d0c97e35b6285ac3e520278ea4cf Merge pull request #2243 from smallstep/dependabot/go_modules/golang.org/x/net-0.39.0
• 46839fedc4922f57da7983f78d17263a646c9cad Bump golang.org/x/net from 0.38.0 to 0.39.0
• 7d7b4ee29f4143a51328bc4fb9ba93b3e50debba Merge pull request #2242 from smallstep/dependabot/go_modules/go.uber.org/mock-0.5.1
• 62e5da4f2d716a04e98c5a935b0a4341271d91f7 Merge pull request #2241 from smallstep/dependabot/go_modules/github.com/prometheus/client_golang-1.22.0
• 6f6b09021521370aa0fbfee1f79eaaaf74ec0ce8 Bump go.uber.org/mock from 0.5.0 to 0.5.1
• 18ac9f6f243d5ffe052cc39ff57d5ed1667746fc Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0
• e21461da3af2ec41f1b1b26e03179d5f30f607e1 Merge pull request #2239 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.37.0
• e40adeeeeb129918dd85a3d37d1142b9c88c6c18 Bump golang.org/x/crypto from 0.36.0 to 0.37.0
• 85fbb41991e9084c2ccb6f0335da00c2e1777d8b Merge pull request #2240 from smallstep/dependabot/go_modules/github.com/coreos/go-oidc/v3-3.14.1
• 1d9909fe898f008e24ce392993048cd52e1f6fe5 Merge pull request #2238 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.71.1
• 7c32a58c4548ec5a2d900dd11cd65cbfd8b1c916 Bump github.com/coreos/go-oidc/v3 from 3.13.0 to 3.14.1
• 7ee4e66aedbc6a669cd330741a40bdc60e2530d4 Bump google.golang.org/grpc from 1.71.0 to 1.71.1
• 534e0493e96562ecaec605550875adca098219fc Merge pull request #2038 from psiman-wandera/wire_subject_test_coverage
• 78b8f50bd402a62ee8c80642f9b693cba9f5f2b9 Merge pull request #2235 from smallstep/herman/fix-flaky-client-timeout-test
• 8815e60a36544b39bb57d5c0ca5fe53e54cdc0e4 Fix flaky client timeout test
• 44f505c34131ef3264239e65dddb038a7d599e4c Add wire subject test coverage
• 60c0b0ab8c9d0b0d47db2d14c295a19eebe5fb9d Merge pull request #2191 from smallstep/mariano/timeout
• 3135a2caecca6e5a94241b935b0fd67a8445999c Add default timeout to CA and Admin client
• d8993aca7c4d3d864f5d84ee82b19353016d3c35 Add option to specify a client timeout
• dd8376c39745d9716ce70609bdd03198e5628ec4 Merge pull request #2233 from smallstep/herman/upgrade-dependencies
• c25c14968f2a84825becee34d8ea4cc6c78667ee Upgrade depenencies
• f94cc2c55e3dd826947769e026faa4a3dd74a80b Merge pull request #2232 from smallstep/dependabot/go_modules/golang.org/x/net-0.38.0
• 7f073dd91abe1436b2e9c0f3499b5e0c06fc49ce Remove toolchain and use Go 1.23.7
• 7aebdc201a6caa965c9fca9e6b2698293f9266c4 Bump golang.org/x/net from 0.37.0 to 0.38.0
• 7198f1f08c6be479419c5f14fc1e40f780511f8a Merge pull request #2225 from smallstep/dependabot/go_modules/google.golang.org/api-0.227.0
• f8cfc0637e3ad28f07c5ecbff65a80433b770e78 Bump google.golang.org/api from 0.224.0 to 0.227.0
• b5fb1f92920d83fdf49a25e6b8061b3aaf9aa014 Merge pull request #2224 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.38.0
• 05d25f60fee902a8790e8499ca2919187639e958 Merge pull request #2223 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.6
• 485b8c855c671c06fda19071988accc79cefcdcb Merge pull request #2222 from smallstep/dependabot/go_modules/github.com/ccoveille/go-safecast-1.6.1
• 28cbf8c9f1b6a904787446912021527737983191 Bump github.com/newrelic/go-agent/v3 from 3.37.0 to 3.38.0
• a8016fe55e9e92e45fb97cfa0958ab691f21e103 Bump google.golang.org/protobuf from 1.36.5 to 1.36.6
• 1a6d6cebbf2d106c64883a4c2ec0c3b1ddc801e4 Bump github.com/ccoveille/go-safecast from 1.6.0 to 1.6.1
• 344dfe69290ec37804409f53e221c58bdda4cddc Merge pull request #2220 from smallstep/dependabot/go_modules/github.com/golang-jwt/jwt/v5-5.2.2
• 5e6209adddcf1778b859f36ac67953e5bcde466d Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2
• 28e905366df84a5b53603f92c9ae18c564d61ce2 Merge pull request #2209 from scop/patch-1
• 78745ba9ff05d489f4bb95789f163217818adf26 empty commit (#2216)
• f3b94096255d92953c219c54def7115ccb13747e Fix cosign cert filename in verify instructions

Thanks!

Those were the changes on v0.28.3-rc2!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.