Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
andrinoff
approved these changes
Apr 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.0.0-20230923063757-afb1ddc0824c→v1.4.1Release Notes
ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)
v1.4.1Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.4.0...v1.4.1
v1.4.1-protonCompare Source
This release is v1.4.1 with support for the following non-standardized features:
v1.4.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.3.0...v1.4.0
v1.4.0-protonCompare Source
This release is v1.4.0 with support for the following non-standardized features:
v1.3.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.2.0...v1.3.0
v1.3.0-protonCompare Source
This release is v1.3.0 with support for the following non-standardized features:
v1.2.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.6...v1.2.0
v1.2.0-protonCompare Source
What's Changed
This release is v1.2.0 with support for the following non-standardized features:
v1.1.6Compare Source
What's Changed
PublicKey.KeyIdStringto return a valid key id by @lubux in #269Full Changelog: ProtonMail/go-crypto@v1.1.5...v1.1.6
v1.1.6-protonCompare Source
What's Changed
This release is v1.1.6 with support for the following non-standardized features:
v1.1.5Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.4...v1.1.5
v1.1.5-protonCompare Source
What's Changed
This release is v1.1.5 with support for the following non-standardized features:
v1.1.4Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.3...v1.1.4
v1.1.4-protonCompare Source
What's Changed
This release is v1.1.4 with support for the following non-standardized features:
v1.1.3Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.2...v1.1.3
v1.1.3-proton.2Compare Source
What's Changed
This release is v1.1.3 with support for the following non-standardized features:
Patches v1.1.3-proton.1:
v1.1.3-proton.1Compare Source
What's Changed
This release is v1.1.3 with support for the following non-standardized features:
Patches v1.1.3-proton:
v1.1.3-protonCompare Source
What's Changed
This release is v1.1.3 with support for the following non-standardized features:
v1.1.2Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.1...v1.1.2
v1.1.2-protonCompare Source
What's Changed
This release is v1.1.2 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.1Compare Source
What's Changed
clearsign.Encodebackwards compatibility #239 by @mdosch in #240Full Changelog: ProtonMail/go-crypto@v1.1.0...v1.1.1
v1.1.1-protonCompare Source
What's Changed
This release is v1.1.1 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0Compare Source
What's Changed
This release adds full support for the new version of the OpenPGP standard, RFC 9580. In addition, the release introduces an improved non-backwards compatible v2 API. The API in the
openpgppackage remains fully backwards compatible while the new v2 API is located in a separatev2package inopenpgp.For the full changes since
v1.0.0, see the previous release notes. For the full changelog, see ProtonMail/go-crypto@v1.0.0...v1.1.0.Changes since
v1.1.0-beta.0:Changelog since
v1.1.0-beta.0: ProtonMail/go-crypto@v1.1.0-beta.0...v1.1.0.v1.1.0-protonCompare Source
What's Changed
This release is v1.1.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-beta.0-protonCompare Source
This pre-release is v1.1.0-beta.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-beta.0Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.5...v1.1.0-beta.0
v1.1.0-alpha.5-protonCompare Source
This pre-release is v1.1.0-alpha.5 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.5Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.4...v1.1.0-alpha.5
v1.1.0-alpha.4-protonCompare Source
This pre-release is v1.1.0-alpha.4 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.4Compare Source
What's Changed
Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.3...v1.1.0-alpha.4
v1.1.0-alpha.3-protonCompare Source
This pre-release is v1.1.0-alpha.3 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.3Compare Source
What's Changed
creation time,issuer key ID, andkey flagsignature sub-packets as criticalFull Changelog: v1.1.0-alpha.2...v1.1.0-alpha.3
v1.1.0-alpha.2-protonCompare Source
v1.1.0-alpha.2Compare Source
v1.1.0-alpha.1-protonCompare Source
This pre-release is v1.1.0-alpha.1 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.1Compare Source
What's Changed
Removes the
openpgp.VerifyDetachedSignatureAndSaltedHashfunction and thepacket.SaltedHashSpecifieras they are no longer required. They were introduced for verifying the headers in cleartext messages. However, in the latest crypto-refresh specification, cleartext message headers were dropped.Full Changelog: v1.1.0-alpha.0...v1.1.0-alpha.1
v1.1.0-alpha.0-protonCompare Source
This pre-release is v1.1.0-alpha.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.
v1.1.0-alpha.0Compare Source
What's Changed
This major pre-release adds full support for the OpenPGP crypto refresh. In addition, the pre-release introduces an improved non-backwards compatible v2 API. The API in the
openpgppackage remains fully backwards compatible while the new v2 API is located in a separatev2package in openpgp.Full Changelog: v1.0.0...v1.1.0-alpha.0
V2 API
Import
The v2 API can be imported as:
V2 API Breaking Changes
openpgp.v2.Entitystruct fields have changed:SelfSignature *packet.SignatureremovedSignatures []*packet.SignatureremovedDirectSignatures []*packet.VerifiableSignatureaddedRevocations []*packet.VerifiableSignaturechanged typeMethods of
openpgp.v2.Entitythat changed:PrimaryIdentity(date time.Time)now requires a time argument.EncryptionKey(date time.Time, config *packet.Config)now requires a new config argument.CertificationKey(date time.Time, config *packet.Config)now requires a new config argument.CertificationKeyById(date time.Time, id uint64, config *packet.Config)now requires a new config argument.SigningKey(date time.Time, config *packet.Config)now requires a new config argument.SigningKeyById(date time.Time, id uint64, config *packet.Config)now requires a new config argument.Revoke(reason packet.ReasonForRevocation, reasonText string, config *packet.Config)is renamed toRevokeKey.Removed methods of
openpgp.v2.Entity:RevokeSubkey(...)is replaced by(Subkey).Revoke(...)openpgp.v2.Subkeystruct fields have changed:Sig *packet.SignatureremovedBindings []*packet.VerifiableSignatureaddedPrimary *Entityadded, pointing to the primary key.Revocations []*packet.VerifiableSignaturechanged typeMethods of
openpgp.v2.Subkeythat changed:Revoked(selfCertification *packet.Signature, date time.Time)now requires a selfCertification argument.openpgp.v2.Identitystruct fields have changed:SelfSignature *packet.SignatureremovedSignatures []*packet.SignatureremovedSelfCertifications []*packet.VerifiableSignatureaddedOtherCertifications []*packet.VerifiableSignatureaddedPrimary *Entityadded, pointing to the primary key.Revocations []*packet.VerifiableSignaturechanged typeMethods of
openpgp.v2.Identitythat changed:Revoked(selfCertification *packet.Signature, date time.Time)now requires a selfCertification argument.openpgp.v2.Keystruct fields have changed:PrimarySelfSignature *packet.Signatureadded, pointing to the selected self signature of the primary key.Revocations []*packet.VerifiableSignaturechanged typeInterface
openpgp.v2.KeyRinghas changed:KeysByIdUsage(...)removedDecryptionKeys(...)removedEntitiesById(id uint64) []*Entityadded. This is the main internal method to access keys from the keyring now.openpgp.v2.FileHintsstruct field has changed:IsBinaryremoved andIsUTF8addedAPI changes in
openpgp.v2for reading messages:VerifyDetachedSignatureAndHash(...)removed; headers in clearsigned messages are no longer checked.VerifyDetachedSignatureAndSaltedHash(...)removedCheckDetachedSignature(...)removed; callVerifyDetachedSignature(...)insteadCheckDetachedSignatureAndSaltedHash(...)removedCheckDetachedSignatureAndHash(...)removedCheckArmoredDetachedSignatureremoved; callVerifyArmoredDetachedSignatureinsteadAPI changes in
openpgp.v2for writing messages:DetachSign(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.ArmoredDetachSign(..., signers []*Entity,..., , params *SignParams)now requires a slice of entities instead of a single entity as an argument and replaces arguments with a SignParams object.DetachSignText(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.ArmoredDetachSignText(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.EncryptText(...)removed; callEncryptWithParams(...)insteadEncryptSplit(...)removed; callEncryptWithParams(...)insteadEncryptTextSplit(...)removed; callEncryptWithParams(...)insteadEncrypt(..., toHidden []*Entity, signers []*Entity)now takes an additional toHidden recipients argument and requires a slice of signer entities instead of a single entity as an argument.Sign(..., signers []*Entity,...)now requires a slice of entities instead of a single entity as an argument.Features
Intended Recipients
Version 2 of the ProtonMail/go-crypto library introduces a feature for including the recipients' key fingerprints in signatures during message encryption. When encrypting and signing a message, the intended recipients are automatically included in the signature unless specifically hidden (i.e., hidden recipients). During the decryption process, if the signature contains intended recipients and the appropriate configuration flag is set, the library verifies whether the primary ID of the decryption key is present in the recipient list. This check can be disabled in the config when a hidden recipient decrypts the message.
Multi-signature Support
In previous iterations of ProtonMail/go-crypto, only a single signature creation and verification were supported in a PGP message. However, in Version 2, the library introduces the ability to sign messages with multiple signatures using different keys, such as a v4 and a v6 key. The encryption and signing methods now accept multiple signing keys as arguments, with each key designated for a specific signature. When reading PGP messages with Version 2, the library maintains an internal state for each known signature and verifies all of them within the message. To facilitate this functionality, the message details struct includes a new field that stores the verification state for each signature. A message is considered valid if at least one of the signatures successfully validates without any errors. For callers, the process of checking for signature errors remains similar to previous versions. However, if the caller requires the verification state of all signatures, they can utilize the new field in the message details struct.
Rework of How Signatures in Keys and Signatures
are Verified
In previous iterations of ProtonMail/go-crypto, key verification occurred during import based on the current time, while signature verification did not involve further key checks. However, this approach had limitations, as invalid keys could have been valid at the time of signature creation and mistakenly considered invalid. Version 2 changes how and when signatures are verified in keys (i.e., direct-signatures, self-signatures of userids, binding signatures in subkeys, revocations, etc). Unlike before, key signature verification no longer takes place during parsing. Instead, keys are now validated when they are utilized, following a similar approach to key handling in OpenPGP.js. Additionally, all signatures and expirations are validated to adhere to the key lifecycle outlined in the RFC. The validity of keys can now be checked at different points in time, leading to the following specific modifications:
Weak Algorithm Rejection
Version 2 introduces the option to specify weak algorithms for signatures in the config. Signatures that use weak algorithms are considered invalid.
Optional Packet Sequence Checker
Version 2 introduces a new feature that enables the validation of packet sequences in PGP messages. This functionality can be enabled in the config struct. In particular, it implements the pushdown automata (PDA) from PGPainless, developed by Paul Schaub. By leveraging this feature, users can ensure that the packet sequences in their PGP messages are valid and comply with the required structure. This addition further enhances the overall reliability and security of PGP message handling in Version 2.
Session Key Encryption and Decryption
Version 2 allows advanced users to retrieve the session key while encrypting a message by setting the respective flag in the config. In decryption, a caller can provide a session key that should be used for decryption.
Unify Write/Read API
Version 2 improves the compatibility between different APIs to allow combinations. The
DetachSignfunction requires the caller to provide aReaderfor the message, while encrypt returns aWriteCloserto which the message is written. The new version adds a functionDetachSignWriter, which returns aWriteClosersimilar to the encryption API. On the reading side, the verify detached signature API now relies on the same signature verification logic as the other read functions. Additionally, a newVerifyDetachedSignatureReadermethod similar to theReadMessageAPI is introduced. It returns a message details struct that once read verifies the signature. Allows chaining different readers from the API, for example, to have a streaming API for encrypted detached signatures.Params Struct as a Function Argument in the Write API
With the inclusion of new features, the write functions in go-crypto experienced significant growth in numbers. Each combination has its dedicated function. Version 2 introduces an
EncryptWithParams/SignWithParamsfunction that takes anEncryptParams/SignParamsstruct as an argument. The struct allows configuring the different features. This approach effectively reduces the number of API methods and simplifies the process of adding new features while maintaining compatibility with previous versions.Others
armor.Encodemethodunarmormore robust to empty header valuesIdentityv1.0.0: Initial releaseCompare Source
First tagged release.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.