realaravinth/forgejo-federation
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity
forgejo-federation/release-notes/4506.md

2 lines
337 B
Markdown
Raw Normal View History

[CHORE] Use github.com/ProtonMail/go-crypto - We were previously using `github.com/keybase/go-crypto`, because the package for openpgp by Go itself is deprecated and no longer maintained. This library provided a maintained version of the openpgp package. However, it hasn't seen any activity for the last five years, and I would therefore consider this also unmaintained. - This patch switches the package to `github.com/ProtonMail/go-crypto` which provides a maintained version of the openpgp package and was already being used in the tests. - Adds unit tests, I've carefully checked the callstacks to ensure the OpenPGP-related code was covered under either a unit test or integration tests to avoid regression, as this can easily turn into security vulnerabilities if a regression happens here. - Small behavior update, revocations are now checked correctly instead of checking if they merely exist and the expiry time of a subkey is used if one is provided (this is just cosmetic and doesn't impact security). - One more dependency eliminated :D
2024-07-15 03:44:00 +05:30
Replaced the openpgp library to use a maintained version, github.com/ProtonMail/go-crypto. This change also went hand in hand with doing correct revocation checks (instead of merely checking if a revocation signature existed) and using the expiration of a subkey if one existed instead of always using the expiration of the default key.
Copy permalink