[dependabot]

Bumps the go-deps group with 1 update: github.com/gematik/zero-lab/go/brainpool.

Updates github.com/gematik/zero-lab/go/brainpool from 1.1.0 to 1.2.0

Changelog

Sourced from github.com/gematik/zero-lab/go/brainpool's changelog.

Release go/brainpool v1.2.0

breaking

• josebp.JWT.HeadersJson and PayloadJson are renamed to HeadersJSON and PayloadJSON; josebp.JSONWebKey.Algortihm is renamed to Algorithm. The JSON encoding of a JWK is unchanged.

fixed

• josebp.ParseToken with WithKey no longer panics on a signature that is shorter than the curve requires; a signature of the wrong length is an error.

changed

• Tests use the standard library only; testify, and with it go.yaml.in/yaml/v3, is no longer a dependency.
• Clean under the workspace golangci-lint configuration; doc comments for the exported josebp API.
• update golang.org/x/crypto to v0.58.0

Release go/pkcs12 v0.100.0

features

• legacy.Decode reads BER-encoded files and RC2-40/128, two-key Triple DES and DES-EDE3-CBC in PBES2 in pure Go; no OpenSSL subprocess any more. New subpackages legacy/ber (BER to DER) and legacy/rc2 (RFC 2268).
• ErrLimitExceeded: iteration counts above 10,000,000 are refused before any key derivation.
• MAC with SHA-224; friendly names with UTF-16 surrogate pairs; passwords outside the BMP encoded as surrogate pairs, as OpenSSL and Java do.
• Language-neutral specification, generated conformance corpus and interoperability matrix in spec/pkcs12.

fixed

• An unknown PBKDF2 PRF fails with ErrUnsupportedAlgorithm instead of falling back to SHA-1.
• EncodeWithOptions no longer modifies the caller's options, honours CertEncryption (certificates are now encrypted by default, as OpenSSL does) and writes hmacWithSHA* as PBKDF2 PRF instead of the digest OID. Files written by earlier versions stay readable.
• Trailing data, unsupported public-key modes and unknown safe content types are rejected instead of ignored.

changed

• legacy.ConvertWithOpenSSL is deprecated and converts in Go.
• Test fixtures with private keys removed; keys are generated per test run.
• License headers in every source file.
• update golang.org/x/crypto to v0.58.0

This lab project ist yet to yield a first release. Stay tuned!

Every module — library and command — is versioned solely by its own git tag go/<module>/vX.Y.Z, bumped only when that module changes. There is no shared version and no version variables. See the Development & Release Guide for the step-by-step workflow.

Local development (go.work)

... (truncated)

Commits

• 9fec33e Merge pull request #55 from gematik/brainpool-deps-lint
• 09a1469 josebp: Go-style field names
• 6907858 brainpool: drop testify, x/crypto v0.58.0, golangci-lint clean
• cf0d519 backlog: TASK-43 ti probe groups TI 1.0 and TI 2.0 endpoints
• c9a6499 Merge pull request #54 from gematik/pin-pkcs12-v0.100.0
• c4f5e70 Pin gemidp to pkcs12 v0.100.0
• bec2437 Merge pull request #53 from gematik/pkcs12-native-legacy
• d09b76b go: workspace-wide golangci-lint configuration
• 741435b spec/pkcs12: requirements, conformance corpus and interop matrix
• 06cfb30 pkcs12: read legacy files in Go, audit-ready layout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like github.com/gematik/zero-lab/go/brainpool is updatable in another way, so this is no longer needed.