Update zlint to just past v3.7.1 (#8800)

Update zlint to get the latest and greatest lint checks. The v3.7.0
release contains a bug where zlint believes that RSA pubkeys are not
actually RSA (because it parses the cert's key into a stdlib
rsa.PublicKey, but then expects to find a forked zcrypto/rsa.PublicKey),
and the v3.7.1 release contains a fix for that but also contains a
second bug (a lint intended only for Subscriber certs also incorrectly
fires on Subordinate CA certs), so this update is to one commit past
v3.7.1.

Update one unit test to set a semi-realistic date, to avoid triggering a
new CRL lint that expects all revocation dates to be reasonably recent.
As a consequence, that test also ignores several additional lints, whose
effective dates are now in that test's past. Update another unit test to
include a CRLDP in the fake certs, to avoid triggering a different new
lint.

Author: aarongable

ca/ca_test.go

@@ -125,7 +125,7 @@ func newCAArgs(t *testing.T) *caArgs {
 	features.Reset()
 
 	fc := clock.NewFake()
-	fc.Add(1 * time.Hour)
+	fc.Set(time.Date(2020, 01, 01, 12, 00, 00, 0, time.UTC))
 
 	pa, err := policy.New(map[identifier.IdentifierType]bool{"dns": true}, nil, blog.NewMock())
 	test.AssertNotError(t, err, "Couldn't create PA")
@@ -135,7 +135,11 @@ func newCAArgs(t *testing.T) *caArgs {
 	legacy, err := issuance.NewProfile(issuance.ProfileConfig{
 		MaxValidityPeriod:   config.Duration{Duration: time.Hour * 24 * 90},
 		MaxValidityBackdate: config.Duration{Duration: time.Hour},
-		IgnoredLints:        []string{"w_subject_common_name_included"},
+		IgnoredLints: []string{
+			"e_sub_cert_aia_does_not_contain_ocsp_url",
+			"w_ct_sct_policy_count_unsatisfied",
+			"n_subject_common_name_included",
+		},
 	})
 	test.AssertNotError(t, err, "Loading test profile")
 	modern, err := issuance.NewProfile(issuance.ProfileConfig{
@@ -145,7 +149,11 @@ func newCAArgs(t *testing.T) *caArgs {
 		OmitSKID:            true,
 		MaxValidityPeriod:   config.Duration{Duration: time.Hour * 24 * 6},
 		MaxValidityBackdate: config.Duration{Duration: time.Hour},
-		IgnoredLints:        []string{"w_ext_subject_key_identifier_missing_sub_cert"},
+		IgnoredLints: []string{
+			"e_sub_cert_aia_does_not_contain_ocsp_url",
+			"w_ct_sct_policy_count_unsatisfied",
+			"w_ext_subject_key_identifier_missing_sub_cert",
+		},
 	})
 	test.AssertNotError(t, err, "Loading test profile")
 	profiles := map[string]*issuance.Profile{

cmd/cert-checker/main_test.go

@@ -595,6 +595,7 @@ func TestIgnoredLint(t *testing.T) {
 	template.DNSNames = []string{"zombo.com"}
 	template.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment
 	template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}
+	template.CRLDistributionPoints = []string{"http://crl.example.org"}
 	template.IsCA = false
 
 	subjectCertDer, err := x509.CreateCertificate(rand.Reader, template, issuerCert, testKey.Public(), testKey)

go.mod

@@ -27,9 +27,9 @@ require (
 	github.com/redis/go-redis/extra/redisotel/v9 v9.5.3
 	github.com/redis/go-redis/v9 v9.10.0
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399
-	github.com/weppos/publicsuffix-go v0.50.3
-	github.com/zmap/zcrypto v0.0.0-20250129210703-03c45d0bae98
-	github.com/zmap/zlint/v3 v3.6.6
+	github.com/weppos/publicsuffix-go v0.50.4-0.20260507075217-1bd47f85b3da
+	github.com/zmap/zcrypto v0.0.0-20260514033604-a1159eb3cad9
+	github.com/zmap/zlint/v3 v3.7.2-0.20260531191521-b88ecfaefc52
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
 	go.opentelemetry.io/otel v1.43.0