Backport of the openpgp migration already merged to main (7c9176ae3)
to dev-v3.
golang.org/x/crypto/openpgp is frozen and flagged by govulncheck as
GO-2026-5932 with no fixed release, leaving the govulncheck check red
on every Go PR targeting dev-v3. Replace it with the maintained
drop-in fork github.com/ProtonMail/go-crypto in pkg/provenance, the
only consumer on this branch.
The only API difference is openpgp.CheckDetachedSignature, which now
takes an io.Reader and a *packet.Config.
Pin the indirect github.com/cloudflare/circl at v1.6.3, as v1.6.2
pulled in by default is itself flagged (GO-2026-4550, fixed in
v1.6.3).
Also backport the mixed RSA/ed25519 keyring sign/verify regression
test from main, adapted to the v3 Signatory API, since keyrings with
modern key algorithms are the main behavioral surface of this swap.
govulncheck ./... now reports 0 vulnerabilities.
Fixes#32361
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Karan V <karanvknarayanan@gmail.com>
(cherry picked from commit bd392c6a60)
Karan V
ab71449c76