[dependabot]

Bumps the go-deps group with 3 updates in the /brainpool directory: github.com/gematik/zero-lab/go/brainpool, github.com/sirosfoundation/go-cryptoutil and golang.org/x/crypto.

Updates github.com/gematik/zero-lab/go/brainpool from 1.1.0 to 1.2.0

Changelog

Sourced from github.com/gematik/zero-lab/go/brainpool's changelog.

Release go/brainpool v1.2.0

breaking

• josebp.JWT.HeadersJson and PayloadJson are renamed to HeadersJSON and PayloadJSON; josebp.JSONWebKey.Algortihm is renamed to Algorithm. The JSON encoding of a JWK is unchanged.

fixed

• josebp.ParseToken with WithKey no longer panics on a signature that is shorter than the curve requires; a signature of the wrong length is an error.

changed

• Tests use the standard library only; testify, and with it go.yaml.in/yaml/v3, is no longer a dependency.
• Clean under the workspace golangci-lint configuration; doc comments for the exported josebp API.
• update golang.org/x/crypto to v0.58.0

Release go/pkcs12 v0.100.0

features

• legacy.Decode reads BER-encoded files and RC2-40/128, two-key Triple DES and DES-EDE3-CBC in PBES2 in pure Go; no OpenSSL subprocess any more. New subpackages legacy/ber (BER to DER) and legacy/rc2 (RFC 2268).
• ErrLimitExceeded: iteration counts above 10,000,000 are refused before any key derivation.
• MAC with SHA-224; friendly names with UTF-16 surrogate pairs; passwords outside the BMP encoded as surrogate pairs, as OpenSSL and Java do.
• Language-neutral specification, generated conformance corpus and interoperability matrix in spec/pkcs12.

fixed

• An unknown PBKDF2 PRF fails with ErrUnsupportedAlgorithm instead of falling back to SHA-1.
• EncodeWithOptions no longer modifies the caller's options, honours CertEncryption (certificates are now encrypted by default, as OpenSSL does) and writes hmacWithSHA* as PBKDF2 PRF instead of the digest OID. Files written by earlier versions stay readable.
• Trailing data, unsupported public-key modes and unknown safe content types are rejected instead of ignored.

changed

• legacy.ConvertWithOpenSSL is deprecated and converts in Go.
• Test fixtures with private keys removed; keys are generated per test run.
• License headers in every source file.
• update golang.org/x/crypto to v0.58.0

This lab project ist yet to yield a first release. Stay tuned!

Every module — library and command — is versioned solely by its own git tag go/<module>/vX.Y.Z, bumped only when that module changes. There is no shared version and no version variables. See the Development & Release Guide for the step-by-step workflow.

Local development (go.work)

... (truncated)

Commits

• 9fec33e Merge pull request #55 from gematik/brainpool-deps-lint
• 09a1469 josebp: Go-style field names
• 6907858 brainpool: drop testify, x/crypto v0.58.0, golangci-lint clean
• cf0d519 backlog: TASK-43 ti probe groups TI 1.0 and TI 2.0 endpoints
• c9a6499 Merge pull request #54 from gematik/pin-pkcs12-v0.100.0
• c4f5e70 Pin gemidp to pkcs12 v0.100.0
• bec2437 Merge pull request #53 from gematik/pkcs12-native-legacy
• d09b76b go: workspace-wide golangci-lint configuration
• 741435b spec/pkcs12: requirements, conformance corpus and interop matrix
• 06cfb30 pkcs12: read legacy files in Go, audit-ready layout
• Additional commits viewable in compare view

Updates github.com/sirosfoundation/go-cryptoutil from 0.6.0 to 0.7.2

Release notes

Sourced from github.com/sirosfoundation/go-cryptoutil's releases.

v0.7.2

What's Changed

• fix(brainpool): support gematik brainpool v1.1.0 (CurveFromOID removed) by @​leifj in sirosfoundation/go-cryptoutil#40

Full Changelog: v0.7.1...v0.7.2

---

This release is versioned as one unit. It consists of the module tags v0.7.2, brainpool/v0.7.2, ecparams/v0.7.2 and pkcs11pool/v0.7.2, all at the same commit. Pin the same version for every module you import:

go get github.com/sirosfoundation/go-cryptoutil@v0.7.2
go get github.com/sirosfoundation/go-cryptoutil/brainpool@v0.7.2
go get github.com/sirosfoundation/go-cryptoutil/ecparams@v0.7.2
go get github.com/sirosfoundation/go-cryptoutil/pkcs11pool@v0.7.2

v0.7.1

What's Changed

• chore(deps): bump the github-actions group across 1 directory with 5 updates by @​dependabot[bot] in sirosfoundation/go-cryptoutil#29
• ecparams: accept zero-padded curve constants and non-DER cA BOOLEAN by @​leifj in sirosfoundation/go-cryptoutil#37
• ci: tag-to-release GitHub Actions workflow by @​leifj in sirosfoundation/go-cryptoutil#35

Full Changelog: v0.7.0...v0.7.1

---

This release is versioned as one unit. It consists of the module tags v0.7.1, brainpool/v0.7.1, ecparams/v0.7.1 and pkcs11pool/v0.7.1, all at the same commit. Pin the same version for every module you import:

go get github.com/sirosfoundation/go-cryptoutil@v0.7.1
go get github.com/sirosfoundation/go-cryptoutil/brainpool@v0.7.1
go get github.com/sirosfoundation/go-cryptoutil/ecparams@v0.7.1
go get github.com/sirosfoundation/go-cryptoutil/pkcs11pool@v0.7.1

v0.7.0 — common versioning and ecparams

Changes

Common versioning

All modules are now released together under one version number (#34). A release vX.Y.Z tags the root module and every nested module on the same commit: vX.Y.Z, brainpool/vX.Y.Z, ecparams/vX.Y.Z, pkcs11pool/vX.Y.Z. Consumers pin the same version for the root and for each nested import path. scripts/release.sh performs the checks and creates the tags; see "Versioning and releases" in the README.

New: ecparams module

Opt-in certificate parser (#33, closes #32) for real-world eMRTD CSCA certificates that Go's crypto/x509 rejects:

... (truncated)

Commits

• 93d3d69 fix(brainpool): support gematik brainpool v1.1.0 (CurveFromOID removed) (#40)
• 28e2ee0 ci: tag-to-release GitHub Actions workflow (#35)
• f79520f ecparams: accept zero-padded curve constants and non-DER cA BOOLEAN (#37)
• 5aa14cf chore(deps): bump the github-actions group across 1 directory with 5 updates ...
• 5531459 Common versioning for all modules; scripts/release.sh (#34)
• 8861406 ecparams: opt-in parser for explicit EC domain parameters (and lenient eMRTD ...
• b58f436 chore(deps): bump SonarSource/sonarqube-scan-action (#13)
• a81fb04 chore(deps): bump the go-deps group across 1 directory with 2 updates (#28)
• b79cf4c ci(scorecard): bump scorecard-action to v2.4.4 (#31)
• 207232b pkcs11pool: stop treating a raw signature that starts with 0x30 as DER (#30)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits

• 8fdf07b go.mod: update golang.org/x dependencies
• 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
• c3db4df acme: prefer test log helpers in test contexts
• 4e01a84 acme: adds support for profiles draft
• 8f0f111 ssh: check that no Unicode-aware string function is used
• b39ff6d ssh: add certificate algorithms for ML-DSA keys
• 4465db3 ssh: add the ML-DSA public key algorithms
• 83e695b ssh: implement ETM mode for CBC ciphers
• 946083a ssh: only drop a trailing carriage return
• 543dde9 ssh: accept known_hosts entries with a multi-word comment
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions