Migrate from golang.org/x/crypto/openpgp to github.com/ProtonMail/go-crypto - #456
Open
G-Gobi wants to merge 1 commit into
Open
Migrate from golang.org/x/crypto/openpgp to github.com/ProtonMail/go-crypto#456G-Gobi wants to merge 1 commit into
G-Gobi wants to merge 1 commit into
Conversation
G-Gobi
force-pushed
the
sha1-md5-removal/go-crypto-migration
branch
from
July 29, 2026 07:41
d946c42 to
7bb0335
Compare
aroradaman
approved these changes
Jul 29, 2026
G-Gobi
force-pushed
the
sha1-md5-removal/go-crypto-migration
branch
from
July 29, 2026 17:07
7bb0335 to
c47ff2e
Compare
…crypto golang.org/x/crypto/openpgp is deprecated and unmaintained upstream. Switch git signature verification and armored key parsing to the actively maintained ProtonMail/go-crypto fork. Signed-off-by: Gobi Ganesan <gobi.ganesan1509@gmail.com>
G-Gobi
force-pushed
the
sha1-md5-removal/go-crypto-migration
branch
from
August 10, 2026 19:22
c47ff2e to
764207b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
golang.org/x/crypto/openpgpto the actively maintainedgithub.com/ProtonMail/go-crypto/openpgpfork.go.mod/go.sumand vendored dependencies accordingly (golang.org/x/cryptois now only an indirect dependency;github.com/ProtonMail/go-cryptoand its transitivegithub.com/cloudflare/circldependency are vendored).Why
golang.org/x/crypto/openpgphas been deprecated by upstream Go maintainers for several years and receives no further updates or fixes.github.com/ProtonMail/go-cryptois a maintained drop-in replacement used widely across the Go ecosystem for this purpose.Changes
pkg/vendir/fetch/git/verification.go: switch import, add requirednilconfig argument toopenpgp.CheckArmoredDetachedSignature.pkg/vendir/openpgparmor/armor.go: switch import.Test plan
go build ./...andgo build -mod=vendor ./...go vet ./...go mod tidy/go mod vendorproduce no further diffgo test ./..., excludingtest/e2ewhich fails only due to a missinghelm3binary in the local environment, unrelated to this change)golangci-lint run(v2.4, matching CI) passes; the one pre-existing finding inarchive_test.gowas confirmed unrelated by reproducing it ondevelopwithout this changehack/build.sh(the repo's own build+vendor+tidy+fmt+smoke-test script) successfully