diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4cc344..0c4d2f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
           echo ${{ github.ref }} | grep "\-rc.*"
           OUT=$?
           if [ $OUT -eq 0 ]; then IS_PRERELEASE=true; else IS_PRERELEASE=false; fi
-          echo "IS_PRERELEASE=${IS_PRERELEASE}" >> ${GITHUB_OUTPUT}
+          echo "IS_PRERELEASE=${IS_PRERELEASE}" >> "${GITHUB_OUTPUT}"
       - name: Create Release
         id: create_release
         uses: actions/create-release@v1
diff --git a/Makefile b/Makefile
index bb5e266..4d3e5ee 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,28 @@
+# Set V to 1 for verbose output from the Makefile
+Q=$(if $V,,@)
+SRC=$(shell find . -type f -name '*.go')
+
+all: lint test
+
+ci: test
+
+.PHONY: all ci
+
+#########################################
+# Bootstrapping
+#########################################
+
+bootstra%:
+	$Q curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$(go env GOPATH)/bin latest
+	$Q go install golang.org/x/vuln/cmd/govulncheck@latest
+	$Q go install gotest.tools/gotestsum@latest
+
+.PHONY: bootstrap
+
+#########################################
+# Test
+#########################################
+
 test:
 	go test -cover ./...
 
@@ -6,3 +31,21 @@ test-race:
 	go test -cover -race ./...
 
 .PHONY: test test-race
+
+#########################################
+# Linting
+#########################################
+
+fmt:
+	$Q goimports -l -w $(SRC)
+
+lint: golint govulncheck
+
+golint: SHELL:=/bin/bash
+golint:
+	$Q LOG_LEVEL=error golangci-lint run --config <(curl -s https://raw.githubusercontent.com/smallstep/workflows/master/.golangci.yml) --timeout=30m
+
+govulncheck:
+	$Q govulncheck ./...
+
+.PHONY: fmt lint golint govulncheck
diff --git a/go.mod b/go.mod
index ae5d638..c40d3b3 100644
--- a/go.mod
+++ b/go.mod
@@ -4,10 +4,13 @@ go 1.16
 
 require (
 	github.com/go-kit/kit v0.4.0
+	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
+)
+
+require (
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-stack/stack v1.6.0 // indirect
-	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
 )
 
 // use github.com/smallstep/pkcs7 fork with patches applied
-replace go.mozilla.org/pkcs7 => github.com/smallstep/pkcs7 v0.0.0-20230302202335-4c094085c948
+replace go.mozilla.org/pkcs7 => github.com/smallstep/pkcs7 v0.0.0-20230615175518-7ce6486b74eb
diff --git a/go.sum b/go.sum
index b486dfb..e3f72df 100644
--- a/go.sum
+++ b/go.sum
@@ -4,5 +4,5 @@ github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNV
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
 github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/smallstep/pkcs7 v0.0.0-20230302202335-4c094085c948 h1:/80FqDt6pzL9clNW8G2IsRAzKGNAuzsEs7g1Y5oaM/Y=
-github.com/smallstep/pkcs7 v0.0.0-20230302202335-4c094085c948/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
+github.com/smallstep/pkcs7 v0.0.0-20230615175518-7ce6486b74eb h1:wWc8z37baPz2oyusY9BVuM+uPtq6XAOb7qSegevnRs0=
+github.com/smallstep/pkcs7 v0.0.0-20230615175518-7ce6486b74eb/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=