chore(deps): update go dependencies to v1 (major) #397
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![red-hat-konflux[bot]](https://avatars.githubusercontent.com/in/296509?s=60&v=4){kind=small}
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Reviewer's GuideThis PR majorly upgrades four indirect Go module dependencies to their v1 releases by updating version constraints in go.mod and regenerating go.sum. Updated Class Diagram for openpgp.v2.Entity in ProtonMail/go-cryptoclassDiagram
class Entity {
<<openpgp.v2.Entity>>
+DirectSignatures []*packet.VerifiableSignature
+Revocations []*packet.VerifiableSignature
+PrimaryIdentity(date time.Time)
+EncryptionKey(date time.Time, config *packet.Config)
+CertificationKey(date time.Time, config *packet.Config)
+CertificationKeyById(date time.Time, id uint64, config *packet.Config)
+SigningKey(date time.Time, config *packet.Config)
+SigningKeyById(date time.Time, id uint64, config *packet.Config)
+RevokeKey(reason packet.ReasonForRevocation, reasonText string, config *packet.Config)
}
Updated Class Diagram for openpgp.v2.Subkey in ProtonMail/go-cryptoclassDiagram
class Subkey {
<<openpgp.v2.Subkey>>
+Bindings []*packet.VerifiableSignature
+Primary *Entity
+Revocations []*packet.VerifiableSignature
+Revoked(selfCertification *packet.Signature, date time.Time)
}
class Entity {
<<openpgp.v2.Entity>>
// Definition as in other diagram
}
Subkey --|> Entity : Primary
Updated Class Diagram for openpgp.v2.Identity in ProtonMail/go-cryptoclassDiagram
class Identity {
<<openpgp.v2.Identity>>
+SelfCertifications []*packet.VerifiableSignature
+OtherCertifications []*packet.VerifiableSignature
+Primary *Entity
+Revocations []*packet.VerifiableSignature
+Revoked(selfCertification *packet.Signature, date time.Time)
}
class Entity {
<<openpgp.v2.Entity>>
// Definition as in other diagram
}
Identity --|> Entity : Primary
Updated Class Diagram for openpgp.v2.Key in ProtonMail/go-cryptoclassDiagram
class Key {
<<openpgp.v2.Key>>
+PrimarySelfSignature *packet.Signature
+Revocations []*packet.VerifiableSignature
}
Updated Class Diagram for openpgp.v2.FileHints in ProtonMail/go-cryptoclassDiagram
class FileHints {
<<openpgp.v2.FileHints>>
+IsUTF8 bool
}
Class Diagram for sigstore/sigstore-go: SignedEntityVerifier Renamed to VerifierclassDiagram
class Verifier {
<<sigstore.Verifier>>
// New verifier interface/type
// Specific methods not detailed in PR description
}
class SignedEntityVerifier {
<<sigstore.SignedEntityVerifier (deprecated)>>
// Old verifier interface/type, now deprecated
}
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.0.0-20230923063757-afb1ddc0824c->v1.3.0v0.0.4->v1.0.0v0.3.16->v1.0.2v0.7.2->v1.0.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)
v1.3.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.2.0...v1.3.0
v1.3.0-protonCompare Source
This release is v1.3.0 with support for the following non-standardized features:
v1.2.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.6...v1.2.0
v1.2.0-protonCompare Source
What's Changed
This release is v1.2.0 with support for the following non-standardized features:
v1.1.6Compare Source
What's Changed
PublicKey.KeyIdStringto return a valid key id by @lubux in https://github.com/ProtonMail/go-crypto/pull/269Full Changelog: ProtonMail/go-crypto@v1.1.5...v1.1.6
v1.1.6-protonCompare Source
What's Changed
This release is v1.1.6 with support for the following non-standardized features:
v1.1.5Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.4...v1.1.5
v1.1.5-protonCompare Source
What's Changed
This release is v1.1.5 with support for the following non-standardized features:
v1.1.4Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.3...v1.1.4
v1.1.4-protonCompare Source
What's Changed
This release is v1.1.4 with support for the following non-standardized features:
v1.1.3Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.2...v1.1.3
v1.1.3-proton.2Compare Source
What's Changed
This release is v1.1.3 with support for the following non-standardized features:
Patches v1.1.3-proton.1:
v1.1.3-proton.1Compare Source
What's Changed
This release is v1.1.3 with support for the following non-standardized features:
Patches v1.1.3-proton:
v1.1.3-protonCompare Source
What's Changed
This release is v1.1.3 with support for the following non-standardized features:
v1.1.2Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.1...v1.1.2
v1.1.2-protonCompare Source
What's Changed
This release is v1.1.2 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.1Compare Source
What's Changed
clearsign.Encodebackwards compatibility #239 by @mdosch in https://github.com/ProtonMail/go-crypto/pull/240Full Changelog: ProtonMail/go-crypto@v1.1.0...v1.1.1
v1.1.1-protonCompare Source
What's Changed
This release is v1.1.1 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0Compare Source
What's Changed
This release adds full support for the new version of the OpenPGP standard, RFC 9580. In addition, the release introduces an improved non-backwards compatible v2 API. The API in the
openpgppackage remains fully backwards compatible while the new v2 API is located in a separatev2package inopenpgp.For the full changes since
v1.0.0, see the previous release notes. For the full changelog, see ProtonMail/go-crypto@v1.0.0...v1.1.0.Changes since
v1.1.0-beta.0:Changelog since
v1.1.0-beta.0: ProtonMail/go-crypto@v1.1.0-beta.0...v1.1.0.v1.1.0-protonCompare Source
What's Changed
This release is v1.1.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-beta.0-protonCompare Source
This pre-release is v1.1.0-beta.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-beta.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.5...v1.1.0-beta.0
v1.1.0-alpha.5-protonCompare Source
This pre-release is v1.1.0-alpha.5 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.5Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.4...v1.1.0-alpha.5
v1.1.0-alpha.4-protonCompare Source
This pre-release is v1.1.0-alpha.4 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.4Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.3...v1.1.0-alpha.4
v1.1.0-alpha.3-protonCompare Source
This pre-release is v1.1.0-alpha.3 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.3Compare Source
What's Changed
creation time,issuer key ID, andkey flagsignature sub-packets as criticalFull Changelog: v1.1.0-alpha.2...v1.1.0-alpha.3
v1.1.0-alpha.2-protonCompare Source
v1.1.0-alpha.2Compare Source
v1.1.0-alpha.1-protonCompare Source
This pre-release is v1.1.0-alpha.1 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.1Compare Source
What's Changed
Removes the
openpgp.VerifyDetachedSignatureAndSaltedHashfunction and thepacket.SaltedHashSpecifieras they are no longer required. They were introduced for verifying the headers in cleartext messages. However, in the latest crypto-refresh specification, cleartext message headers were dropped.Full Changelog: v1.1.0-alpha.0...v1.1.0-alpha.1
v1.1.0-alpha.0-protonCompare Source
This pre-release is v1.1.0-alpha.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.0Compare Source
What's Changed
This major pre-release adds full support for the OpenPGP crypto refresh. In addition, the pre-release introduces an improved non-backwards compatible v2 API. The API in the
openpgppackage remains fully backwards compatible while the new v2 API is located in a separatev2package in openpgp.Full Changelog: v1.0.0...v1.1.0-alpha.0
V2 API
Import
The v2 API can be imported as:
V2 API Breaking Changes
openpgp.v2.Entitystruct fields have changed:SelfSignature *packet.SignatureremovedSignatures []*packet.SignatureremovedDirectSignatures []*packet.VerifiableSignatureaddedRevocations []*packet.VerifiableSignaturechanged typeMethods of
openpgp.v2.Entitythat changed:PrimaryIdentity(date time.Time)now requires a time argument.EncryptionKey(date time.Time, config *packet.Config)now requires a new config argument.CertificationKey(date time.Time, config *packet.Config)now requires a new config argument.CertificationKeyById(date time.Time, id uint64, config *packet.Config)now requires a new config argument.SigningKey(date time.Time, config *packet.Config)now requires a new config argument.SigningKeyById(date time.Time, id uint64, config *packet.Config)now requires a new config argument.Revoke(reason packet.ReasonForRevocation, reasonText string, config *packet.Config)is renamed toRevokeKey.Removed methods of
openpgp.v2.Entity:RevokeSubkey(...)is replaced by(Subkey).Revoke(...)openpgp.v2.Subkeystruct fields have changed:Sig *packet.SignatureremovedBindings []*packet.VerifiableSignatureaddedPrimary *Entityadded, pointing to the primary key.Revocations []*packet.VerifiableSignaturechanged typeMethods of
openpgp.v2.Subkeythat changed:Revoked(selfCertification *packet.Signature, date time.Time)now requires a selfCertification argument.openpgp.v2.Identitystruct fields have changed:SelfSignature *packet.SignatureremovedSignatures []*packet.SignatureremovedSelfCertifications []*packet.VerifiableSignatureaddedOtherCertifications []*packet.VerifiableSignatureaddedPrimary *Entityadded, pointing to the primary key.Revocations []*packet.VerifiableSignaturechanged typeMethods of
openpgp.v2.Identitythat changed:Revoked(selfCertification *packet.Signature, date time.Time)now requires a selfCertification argument.openpgp.v2.Keystruct fields have changed:PrimarySelfSignature *packet.Signatureadded, pointing to the selected self signature of the primary key.Revocations []*packet.VerifiableSignaturechanged typeInterface
openpgp.v2.KeyRinghas changed:KeysByIdUsage(...)removedDecryptionKeys(...)removedEntitiesById(id uint64) []*Entityadded. This is the main internal method to access keys from the keyring now.openpgp.v2.FileHintsstruct field has changed:IsBinaryremoved andIsUTF8addedAPI changes in
openpgp.v2for reading messages:VerifyDetachedSignatureAndHash(...)removed; headers in clearsigned messages are no longer checked.VerifyDetachedSignatureAndSaltedHash(...)removedCheckDetachedSignature(...)removed; callVerifyDetachedSignature(...)insteadCheckDetachedSignatureAndSaltedHash(...)removedCheckDetachedSignatureAndHash(...)removedCheckArmoredDetachedSignatureremoved; callVerifyArmoredDetachedSignatureinsteadAPI changes in
openpgp.v2for writing messages:DetachSign(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.ArmoredDetachSign(..., signers []*Entity,..., , params *SignParams)now requires a slice of entities instead of a single entity as an argument and replaces arguments with a SignParams object.DetachSignText(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.ArmoredDetachSignText(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.EncryptText(...)removed; callEncryptWithParams(...)insteadEncryptSplit(...)removed; callEncryptWithParams(...)insteadEncryptTextSplit(...)removed; callEncryptWithParams(...)insteadEncrypt(..., toHidden []*Entity, signers []*Entity)now takes an additional toHidden recipients argument and requires a slice of signer entities instead of a single entity as an argument.Sign(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.Features
Intended Recipients
Version 2 of the ProtonMail/go-crypto library introduces a feature for including the recipients' key fingerprints in signatures during message encryption. When encrypting and signing a message, the intended recipients are automatically included in the signature unless specifically hidden (i.e., hidden recipients). During the decryption process, if the signature contains intended recipients and the appropriate configuration flag is set, the library verifies whether the primary ID of the decryption key is present in the recipient list. This check can be disabled in the config when a hidden recipient decrypts the message.
Multi-signature Support
In previous iterations of ProtonMail/go-crypto, only a single signature creation and verification were supported in a PGP message. However, in Version 2, the library introduces the ability to sign messages with multiple signatures using different keys, such as a v4 and a v6 key. The encryption and signing methods now accept multiple signing keys as arguments, with each key designated for a specific signature. When reading PGP messages with Version 2, the library maintains an internal state for each known signature and verifies all of them within the message. To facilitate this functionality, the message details struct includes a new field that stores the verification state for each signature. A message is considered valid if at least one of the signatures successfully validates without any errors. For callers, the process of checking for signature errors remains similar to previous versions. However, if the caller requires the verification state of all signatures, they can utilize the new field in the message details struct.
Rework of How Signatures in Keys and Signatures
are Verified
In previous iterations of ProtonMail/go-crypto, key verification occurred during import based on the current time, while signature verification did not involve further key checks. However, this approach had limitations, as invalid keys could have been valid at the time of signature creation and mistakenly considered invalid. Version 2 changes how and when signatures are verified in keys (i.e., direct-signatures, self-signatures of userids, binding signatures in subkeys, revocations, etc). Unlike before, key signature verification no longer takes place during parsing. Instead, keys are now validated when they are utilized, following a similar approach to key handling in OpenPGP.js. Additionally, all signatures and expirations are validated to adhere to the key lifecycle outlined in the RFC. The validity of keys can now be checked at different points in time, leading to the following specific modifications:
Weak Algorithm Rejection
Version 2 introduces the option to specify weak algorithms for signatures in the config. Signatures that use weak algorithms are considered invalid.
Optional Packet Sequence Checker
Version 2 introduces a new feature that enables the validation of packet sequences in PGP messages. This functionality can be enabled in the config struct. In particular, it implements the pushdown automata (PDA) from PGPainless, developed by Paul Schaub. By leveraging this feature, users can ensure that the packet sequences in their PGP messages are valid and comply with the required structure. This addition further enhances the overall reliability and security of PGP message handling in Version 2.
Session Key Encryption and Decryption
Version 2 allows advanced users to retrieve the session key while encrypting a message by setting the respective flag in the config. In decryption, a caller can provide a session key that should be used for decryption.
Unify Write/Read API
Version 2 improves the compatibility between different APIs to allow combinations. The
DetachSignfunction requires the caller to provide aReaderfor the message, while encrypt returns aWriteCloserto which the message is written. The new version adds a functionDetachSignWriter, which returns aWriteClosersimilar to the encryption API. On the reading side, the verify detached signature API now relies on the same signature verification logic as the other read functions. Additionally, a newVerifyDetachedSignatureReadermethod similar to theReadMessageAPI is introduced. It returns a message details struct that once read verifies the signature. Allows chaining different readers from the API, for example, to have a streaming API for encrypted detached signatures.Params Struct as a Function Argument in the Write API
With the inclusion of new features, the write functions in go-crypto experienced significant growth in numbers. Each combination has its dedicated function. Version 2 introduces an
EncryptWithParams/SignWithParamsfunction that takes anEncryptParams/SignParamsstruct as an argument. The struct allows configuring the different features. This approach effectively reduces the number of API methods and simplifies the process of adding new features while maintaining compatibility with previous versions.Others
armor.Encodemethodunarmormore robust to empty header valuesIdentityv1.0.0: Initial releaseCompare Source
First tagged release.
golang/snappy (github.com/golang/snappy)
v1.0.0Compare Source
Latest stable version, as of March 2025.
imdario/mergo (github.com/imdario/mergo)
v1.0.2Compare Source
What's Changed
gopkg.in/yaml.v3, only used for loading fixtures. Thanks @trim21 for bringing to my attention (#262) that this library is no longer maintained.Full Changelog: darccio/mergo@v1.0.1...v1.0.2
v1.0.1Compare Source
What's Changed
WithoutDereferenceshould respect non-nil struct pointers by @joshkaplinsky in https://github.com/darccio/mergo/pull/251New Contributors
Full Changelog: darccio/mergo@v1.0.0...v1.0.1
v1.0.0: 1.0.0 released with new module URL: dario.cat/mergoCompare Source
This PR is a release containing 0.3.15 features but changing the module URL to
dario.cat/mergo.What's Changed
Full Changelog: darccio/mergo@v0.3.16...v1.0.0
sigstore/sigstore-go (github.com/sigstore/sigstore-go)
v1.0.0Compare Source
We're very excited to release sigstore-go 1.0! View the blog post announcing this release for more details.
This release should contain the last set of breaking changes until version 2.0, including a few renames (such as SignedEntityVerifier -> Verifier and VerifyTimestampAuthority -> VerifySignedTimestamp). We are excited to begin a new phase of simple, stable APIs!
What's Changed
theupdateframework/go-tuf/examples/repositorydirectory by @malancas in https://github.com/sigstore/sigstore-go/pull/474Full Changelog: sigstore/sigstore-go@v0.7.3...v1.0.0
v0.7.3Compare Source
Note: v0.7.3 will likely be the last release before v1.0.
What's Changed
Full Changelog: sigstore/sigstore-go@v0.7.2...v0.7.3
Configuration
📅 Schedule: Branch creation - "after 5am on sunday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
To execute skipped test pipelines write comment
/ok-to-test.This PR has been generated by MintMaker (powered by Renovate Bot).