Release gopenpgp v3.4.0

.github/workflows/go.yml

@@ -28,9 +28,9 @@ jobs:
     steps:
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23'
       - uses: actions/checkout@v4
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.54.2
+          version: v1.64.5

.github/workflows/ios.yml

@@ -12,10 +12,10 @@ jobs:
     runs-on: macos-latest
 
     steps:
-      - name: Set up xcode 15.3.0
+      - name: Set up xcode 16.0.0
         uses: maxim-lobanov/setup-xcode@v1
         with:
-          xcode-version: 15.3.0
+          xcode-version: 16.0.0
         id: xcode
 
       - name: Set up Go 1.x

.golangci.yml

@@ -20,6 +20,11 @@ issues:
     - ST1003  # CamelCase variables; see constants/cipher.go
     - missing output for example, go test can't validate it
     - variable 'hasExpiredEntity' is only used in the if-statement
+    - G101
+    - Magic number
+    - param max has same name as predeclared identifier
+    - G115
+    - the methods of "signatureCollector"
   exclude-rules:
     - path: crypto/key_clear.go
       text: "SA1019"
@@ -31,6 +36,8 @@ issues:
       text: "Using the variable on range scope"
     - path: crypto/sign_verify_test.go
       text: "Using the variable on range scope"
+    - path: crypto/interop_test.go
+      text: "G101: Potential hardcoded credentials"
 
 linters:
   enable-all: true

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.4.0] – 2026-03-18
+### Added
+- `InsecureAllowAllKeyFlagsWhenMissing` profile option. Allows usage of keys without key flags.
+
+### Changed
+- Upgraded `go-crypto` fork to **v1.4.1**.
+
 ## [3.3.0] – 2025-05-23
 ### Added
 - MaxDecompressedSize option to control the maximum size of decompressed messages.

constants/version.go

@@ -1,3 +1,3 @@
 package constants
 
-const Version = "3.3.0"
+const Version = "3.4.0"

crypto/encrypt_decrypt_test.go

@@ -927,7 +927,7 @@ func TestEncryptDecryptKey(t *testing.T) {
 func TestEncryptCompressionApplied(t *testing.T) {
 	const numReplicas = 10
 	builder := strings.Builder{}
-	for i := 0; i < numReplicas; i++ {
+	for range numReplicas {
 		builder.WriteString(testMessage)
 	}
 	messageToEncrypt := builder.String()

crypto/keyring_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
 	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
@@ -121,11 +122,11 @@ func TestKeyIds(t *testing.T) {
 }
 
 func TestMultipleKeyRing(t *testing.T) {
-	assert.Exactly(t, 3, len(keyRingTestMultiple.entities))
+	assert.Len(t, keyRingTestMultiple.entities, 3)
 	assert.Exactly(t, 3, keyRingTestMultiple.CountEntities())
 	assert.Exactly(t, 3, keyRingTestMultiple.CountDecryptionEntities(testTime))
 
-	assert.Exactly(t, 3, len(keyRingTestMultiple.GetKeys()))
+	assert.Len(t, keyRingTestMultiple.GetKeys(), 3)
 
 	testKey, err := keyRingTestMultiple.GetKey(1)
 	if err != nil {
@@ -134,28 +135,28 @@ func TestMultipleKeyRing(t *testing.T) {
 	assert.Exactly(t, keyTestEC, testKey)
 
 	_, err = keyRingTestMultiple.GetKey(3)
-	assert.NotNil(t, err)
+	require.Error(t, err)
 
 	singleKeyRing, err := keyRingTestMultiple.FirstKey()
 	if err != nil {
 		t.Fatal("Expected no error while filtering the first key, got:", err)
 	}
-	assert.Exactly(t, 1, len(singleKeyRing.entities))
+	assert.Len(t, singleKeyRing.entities, 1)
 	assert.Exactly(t, 1, singleKeyRing.CountEntities())
 	assert.Exactly(t, 1, singleKeyRing.CountDecryptionEntities(testTime))
 }
 
 func TestSerializeParse(t *testing.T) {
 	serialized, err := keyRingTestMultiple.Serialize()
-	assert.Nil(t, err)
+	require.NoError(t, err)
 
 	parsed, err := NewKeyRingFromBinary(serialized)
-	assert.Nil(t, err)
+	require.NoError(t, err)
 
-	assert.Exactly(t, 3, len(parsed.GetKeys()))
+	assert.Len(t, parsed.GetKeys(), 3)
 	for i, parsedKey := range parsed.GetKeys() {
 		expectedKey, err := keyRingTestMultiple.GetKey(i)
-		assert.Nil(t, err)
+		require.NoError(t, err)
 		assert.Exactly(t, parsedKey.GetFingerprint(), expectedKey.GetFingerprint())
 	}
 }
@@ -167,7 +168,7 @@ func TestClearPrivateKey(t *testing.T) {
 	}
 
 	for _, key := range keyRingCopy.GetKeys() {
-		assert.Nil(t, clearPrivateKey(key.entity.PrivateKey.PrivateKey))
+		require.NoError(t, clearPrivateKey(key.entity.PrivateKey.PrivateKey))
 	}
 
 	keys := keyRingCopy.GetKeys()

crypto/message_test.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestTextMessageEncryptionWithPassword(t *testing.T) {
@@ -32,7 +33,7 @@ func TestTextMessageEncryptionWithPassword(t *testing.T) {
 		}
 		sessionKey, ok := p.(*packet.SymmetricKeyEncrypted)
 		if ok {
-			assert.Equal(t, sessionKey.CipherFunc, packet.CipherAES256)
+			assert.Equal(t, packet.CipherAES256, sessionKey.CipherFunc)
 			foundSk = true
 			break
 		}
@@ -43,7 +44,7 @@ func TestTextMessageEncryptionWithPassword(t *testing.T) {
 	// Decrypt data with wrong password
 	decryptorWrong, _ := testPGP.Decryption().Password([]byte("Wrong password")).New()
 	_, err = decryptorWrong.Decrypt(encrypted.Bytes(), Bytes)
-	assert.NotNil(t, err)
+	require.Error(t, err)
 
 	// Decrypt data with the good password
 	decryptor, _ := testPGP.Decryption().Password(testSymmetricKey).New()
@@ -67,7 +68,7 @@ func TestBinaryMessageEncryptionWithPassword(t *testing.T) {
 	// Decrypt data with wrong password
 	decryptorWrong, _ := testPGP.Decryption().Password([]byte("Wrong password")).New()
 	_, err = decryptorWrong.Decrypt(encrypted.Bytes(), Bytes)
-	assert.NotNil(t, err)
+	require.Error(t, err)
 
 	// Decrypt data with the good password
 	decryptor, _ := testPGP.Decryption().Password(testSymmetricKey).New()
@@ -305,7 +306,7 @@ func TestSHA1SignedMessageDecryption(t *testing.T) {
 
 func TestMultipleKeyMessageEncryption(t *testing.T) {
 	var message = []byte("plain text")
-	assert.Exactly(t, 3, len(keyRingTestMultiple.entities))
+	assert.Len(t, keyRingTestMultiple.entities, 3)
 
 	encryptor, _ := testPGP.Encryption().Recipients(keyRingTestMultiple).SigningKeys(keyRingTestPrivate).New()
 	ciphertext, err := encryptor.Encrypt(message)
@@ -317,7 +318,7 @@ func TestMultipleKeyMessageEncryption(t *testing.T) {
 	// followed by a single symmetrically encrypted data packet (tag 18)
 	var p packet.Packet
 	packets := packet.NewReader(bytes.NewReader(ciphertext.Bytes()))
-	for i := 0; i < 3; i++ {
+	for range 3 {
 		if p, err = packets.Next(); err != nil {
 			t.Fatal(err.Error())
 		}
@@ -349,15 +350,15 @@ func TestMultipleKeyMessageEncryption(t *testing.T) {
 
 func TestMessageGetEncryptionKeyIDs(t *testing.T) {
 	var message = []byte("plain text")
-	assert.Exactly(t, 3, len(keyRingTestMultiple.entities))
+	assert.Len(t, keyRingTestMultiple.entities, 3)
 
 	encryptor, _ := testPGP.Encryption().Recipients(keyRingTestMultiple).SigningKeys(keyRingTestPrivate).New()
 	ciphertext, err := encryptor.Encrypt(message)
 	if err != nil {
 		t.Fatal("Expected no error when encrypting, got:", err)
 	}
 	ids, ok := ciphertext.EncryptionKeyIDs()
-	assert.Exactly(t, 3, len(ids))
+	assert.Len(t, ids, 3)
 	assert.True(t, ok)
 	encKey, ok := keyRingTestMultiple.entities[0].EncryptionKey(time.Now(), nil)
 	assert.True(t, ok)
@@ -371,7 +372,7 @@ func TestMessageGetHexGetEncryptionKeyIDs(t *testing.T) {
 	}
 
 	ids, ok := ciphertext.HexEncryptionKeyIDs()
-	assert.Exactly(t, 2, len(ids))
+	assert.Len(t, ids, 2)
 	assert.True(t, ok)
 
 	assert.Exactly(t, "76ad736fa7e0e83c", ids[0])
@@ -388,7 +389,7 @@ func TestMessageGetSignatureKeyIDs(t *testing.T) {
 	}
 
 	ids, ok := SignatureKeyIDs(signature)
-	assert.Exactly(t, 1, len(ids))
+	assert.Len(t, ids, 1)
 	assert.True(t, ok)
 	signingKey, ok := keyRingTestPrivate.entities[0].SigningKey(time.Now(), nil)
 	assert.True(t, ok)
@@ -402,7 +403,7 @@ func TestMessageGetHexSignatureKeyIDs(t *testing.T) {
 	}
 
 	ids, ok := ciphertext.HexSignatureKeyIDs()
-	assert.Exactly(t, 2, len(ids))
+	assert.Len(t, ids, 2)
 	assert.True(t, ok)
 
 	assert.Exactly(t, "3eb6259edf21df24", ids[0])

crypto/sessionkey_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/ProtonMail/gopenpgp/v3/constants"
 	"github.com/ProtonMail/gopenpgp/v3/profile"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 var testSessionKey *SessionKey
@@ -81,7 +82,7 @@ func TestSymmetricKeyPacket(t *testing.T) {
 	decHandle, _ := testPGP.Decryption().Password([]byte("Wrong password")).New()
 	wrongSymmetricKey, err := decHandle.DecryptSessionKey(keyPacket)
 	if err != nil {
-		assert.EqualError(t, err, "gopenpgp: unable to decrypt any packet")
+		require.EqualError(t, err, "gopenpgp: unable to decrypt any packet")
 	} else {
 		assert.NotEqual(t, testSessionKey, wrongSymmetricKey)
 	}
@@ -134,7 +135,7 @@ func TestDataPacketEncryption(t *testing.T) {
 	}
 	decryptor, _ := testPGP.Decryption().SessionKey(wrongKey).New()
 	_, err = decryptor.Decrypt(pgpMessage.BinaryDataPacket(), Bytes)
-	assert.NotNil(t, err)
+	require.Error(t, err)
 
 	// Decrypt data with the good session key
 	decryptor, _ = testPGP.Decryption().SessionKey(testSessionKey).New()
@@ -145,7 +146,7 @@ func TestDataPacketEncryption(t *testing.T) {
 	assert.Exactly(t, message, decrypted.Bytes())
 
 	// Encrypt session key
-	assert.Exactly(t, 3, len(keyRingTestMultiple.entities))
+	assert.Len(t, keyRingTestMultiple.entities, 3)
 	encryptor, _ = testPGP.Encryption().Recipients(keyRingTestMultiple).New()
 	keyPackets, err := encryptor.EncryptSessionKey(testSessionKey)
 	if err != nil {
@@ -167,7 +168,7 @@ func TestDataPacketEncryption(t *testing.T) {
 	}
 	ids, ok := pgpMessage.EncryptionKeyIDs()
 	assert.True(t, ok)
-	assert.Exactly(t, 3, len(ids))
+	assert.Len(t, ids, 3)
 
 	// Test if final decryption succeeds
 	decryptor, _ = testPGP.Decryption().DecryptionKeys(keyRingTestPrivate).New()
@@ -239,7 +240,7 @@ func TestDataPacketEncryptionAndSignature(t *testing.T) {
 	}
 	decryptor, _ := testPGP.Decryption().SessionKey(wrongKey).New()
 	_, err = decryptor.Decrypt(pgpMessage.BinaryDataPacket(), Bytes)
-	assert.NotNil(t, err)
+	require.Error(t, err)
 
 	// Decrypt data with the good session key
 	decryptor, _ = testPGP.Decryption().SessionKey(testSessionKey).New()
@@ -276,7 +277,7 @@ func TestDataPacketEncryptionAndSignature(t *testing.T) {
 	assert.Exactly(t, message, decrypted.Bytes())
 
 	// Encrypt session key
-	assert.Exactly(t, 3, len(keyRingTestMultiple.entities))
+	assert.Len(t, keyRingTestMultiple.entities, 3)
 	encryptor, _ = testPGP.Encryption().Recipients(keyRingTestMultiple).New()
 	keyPacket, err := encryptor.EncryptSessionKey(testSessionKey)
 	if err != nil {
@@ -298,7 +299,7 @@ func TestDataPacketEncryptionAndSignature(t *testing.T) {
 	}
 	ids, ok := pgpMessage.EncryptionKeyIDs()
 	assert.True(t, ok)
-	assert.Exactly(t, 3, len(ids))
+	assert.Len(t, ids, 3)
 
 	// Test if final decryption & verification succeeds
 	decryptor, _ = testPGP.Decryption().DecryptionKeys(keyRingTestPrivate).VerificationKeys(keyRingTestPublic).New()
@@ -345,7 +346,7 @@ func TestMDCFailDecryption(t *testing.T) {
 
 	decryptor, _ := testPGP.Decryption().SessionKey(sessionKey).New()
 	_, err = decryptor.Decrypt(pgpMessage.BinaryDataPacket(), Bytes)
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }
 
 func TestAsymmetricKeyPacketDecryptionFailure(t *testing.T) {

crypto/signature_test.go

@@ -176,9 +176,6 @@ func Test_KeyRing_GetVerifiedSignatureTimestampSuccess(t *testing.T) {
 		t.Fatal(err)
 	}
 	actualTime := verificationResult.SignatureCreationTime()
-	if err != nil {
-		t.Errorf("Got an error while parsing the signature creation time: %v", err)
-	}
 	if timeLocal != actualTime {
 		t.Errorf("Expected creation time to be %d, got %d", timeLocal, actualTime)
 	}
@@ -226,9 +223,6 @@ func Test_KeyRing_GetVerifiedSignatureWithTwoKeysTimestampSuccess(t *testing.T)
 	}
 	actualTime := verificationResult.SignatureCreationTime()
 	otherTime := verificationResult.Signatures[1].Signature.CreationTime.Unix()
-	if err != nil {
-		t.Errorf("Got an error while parsing the signature creation time: %v", err)
-	}
 
 	if time2 != otherTime {
 		t.Errorf("Expected creation time to be %d, got %d", otherTime, time2)

go.mod

@@ -1,21 +1,21 @@
 module github.com/ProtonMail/gopenpgp/v3
 
-go 1.22.0
+go 1.23.0
 
 require (
-	github.com/ProtonMail/go-crypto v1.3.0
+	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f
 	github.com/stretchr/testify v1.10.0
 )
 
 require (
-	github.com/cloudflare/circl v1.6.0 // indirect
+	github.com/cloudflare/circl v1.6.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/kr/pretty v0.2.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/crypto v0.33.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )