From ab17711e313ad0c869ac45a481d54f8d760685ad Mon Sep 17 00:00:00 2001 From: Sergey Kolomiichuk <19serega89@mail.ru> Date: Sun, 20 Sep 2026 21:33:24 +0300 Subject: [PATCH] selfupdate: replace deprecated golang.org/x/crypto/openpgp with ProtonMail/go-crypto (#21997) --- .golangci.yml | 2 -- changelog/unreleased/issue-21973 | 8 ++++++++ go.mod | 2 ++ go.sum | 4 ++++ internal/selfupdate/verify.go | 4 ++-- 5 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 changelog/unreleased/issue-21973 diff --git a/.golangci.yml b/.golangci.yml index 0482253b0..b896f9e12 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -79,8 +79,6 @@ linters: # staticcheck: there's no easy way to replace these packages - path: (.+)\.go$ text: 'SA1019: "golang.org/x/crypto/poly1305" is deprecated' - - path: (.+)\.go$ - text: 'SA1019: "golang.org/x/crypto/openpgp" is deprecated' - path: (.+)\.go$ text: "redefines-builtin-id:" # revive: collection of helpers to implement a backend, more descriptive names would be too repetitive diff --git a/changelog/unreleased/issue-21973 b/changelog/unreleased/issue-21973 new file mode 100644 index 000000000..80ca7752a --- /dev/null +++ b/changelog/unreleased/issue-21973 @@ -0,0 +1,8 @@ +Enhancement: Replace deprecated GPG verification library used for self-update + +Restic used the unmaintained and insecure golang.org/x/crypto/openpgp +package to verify GPG signatures during self-update. It now uses the +actively maintained ProtonMail/go-crypto fork instead, which addresses +known security weaknesses in the original package. + +https://github.com/restic/restic/issues/21973 diff --git a/go.mod b/go.mod index adf3912ec..8bd874b31 100644 --- a/go.mod +++ b/go.mod @@ -15,6 +15,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0 github.com/Backblaze/blazer v0.7.2 github.com/Microsoft/go-winio v0.6.2 + github.com/ProtonMail/go-crypto v1.4.1 github.com/anacrolix/fuse v0.3.1 github.com/cenkalti/backoff/v4 v4.3.0 github.com/cespare/xxhash/v2 v2.3.0 @@ -58,6 +59,7 @@ require ( github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect + github.com/cloudflare/circl v1.6.2 // indirect github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect github.com/dustin/go-humanize v1.0.1 // indirect diff --git a/go.sum b/go.sum index 8fabe78a0..0ed621e6b 100644 --- a/go.sum +++ b/go.sum @@ -49,6 +49,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapp github.com/Julusian/godocdown v0.0.0-20170816220326-6d19f8ff2df8/go.mod h1:INZr5t32rG59/5xeltqoCJoNY7e5x/3xoY9WSWVWg74= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= +github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM= +github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= github.com/anacrolix/envpprof v1.3.0 h1:WJt9bpuT7A/CDCxPOv/eeZqHWlle/Y0keJUvc6tcJDk= github.com/anacrolix/envpprof v1.3.0/go.mod h1:7QIG4CaX1uexQ3tqd5+BRa/9e2D02Wcertl6Yh0jCB0= github.com/anacrolix/fuse v0.3.1 h1:oT8s3B5HFkBdLe/WKJO5MNo9iIyEtc+BhvTZYp4jhDM= @@ -65,6 +67,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/cloudflare/circl v1.6.2 h1:hL7VBpHHKzrV5WTfHCaBsgx/HGbBYlgrwvNXEVDYYsQ= +github.com/cloudflare/circl v1.6.2/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0= diff --git a/internal/selfupdate/verify.go b/internal/selfupdate/verify.go index 558c27965..e2c034003 100644 --- a/internal/selfupdate/verify.go +++ b/internal/selfupdate/verify.go @@ -4,7 +4,7 @@ import ( "bytes" "fmt" - "golang.org/x/crypto/openpgp" + "github.com/ProtonMail/go-crypto/openpgp" ) var key = []byte(` @@ -177,7 +177,7 @@ func GPGVerify(data, sig []byte) (ok bool, err error) { return false, fmt.Errorf("reading keyring failed: %w", err) } - _, err = openpgp.CheckArmoredDetachedSignature(keyring, bytes.NewReader(data), bytes.NewReader(sig)) + _, err = openpgp.CheckArmoredDetachedSignature(keyring, bytes.NewReader(data), bytes.NewReader(sig), nil) if err != nil { return false, err }