You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Karan V bd392c6a60 fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 ... Backport of the openpgp migration already merged to main (7c9176ae3) to dev-v3. golang.org/x/crypto/openpgp is frozen and flagged by govulncheck as GO-2026-5932 with no fixed release, leaving the govulncheck check red on every Go PR targeting dev-v3. Replace it with the maintained drop-in fork github.com/ProtonMail/go-crypto in pkg/provenance, the only consumer on this branch. The only API difference is openpgp.CheckDetachedSignature, which now takes an io.Reader and a *packet.Config. Pin the indirect github.com/cloudflare/circl at v1.6.3, as v1.6.2 pulled in by default is itself flagged (GO-2026-4550, fixed in v1.6.3). Also backport the mixed RSA/ed25519 keyring sign/verify regression test from main, adapted to the v3 Signatory API, since keyrings with modern key algorithms are the main behavioral surface of this swap. govulncheck ./... now reports 0 vulnerabilities. Fixes #32361 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Karan V <karanvknarayanan@gmail.com>		2 weeks ago
..
testdata	fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932	2 weeks ago
doc.go	Bump the Go version	3 years ago
sign.go	fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932	2 weeks ago
sign_test.go	fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932	2 weeks ago