From 790dc93c6565df38fb92ae8c8fb60e45297a1ed0 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Wed, 11 Aug 2021 15:43:27 -0400 Subject: [PATCH] openpgp: mark as deprecated Finally. Fixes golang/go#44226 Change-Id: I73de5a49357f8891afef9094ab497f389b899943 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/341549 Trust: Filippo Valsorda Run-TryBot: Filippo Valsorda TryBot-Result: Go Bot Reviewed-by: Roland Shoemaker --- openpgp/armor/armor.go | 6 ++++++ openpgp/clearsign/clearsign.go | 6 ++++++ openpgp/elgamal/elgamal.go | 6 ++++++ openpgp/errors/errors.go | 6 ++++++ openpgp/packet/packet.go | 6 ++++++ openpgp/read.go | 6 ++++++ openpgp/s2k/s2k.go | 6 ++++++ 7 files changed, 42 insertions(+) diff --git a/openpgp/armor/armor.go b/openpgp/armor/armor.go index 36a6804..d1656d4 100644 --- a/openpgp/armor/armor.go +++ b/openpgp/armor/armor.go @@ -4,6 +4,12 @@ // Package armor implements OpenPGP ASCII Armor, see RFC 4880. OpenPGP Armor is // very similar to PEM except that it has an additional CRC checksum. +// +// Deprecated: this package is unmaintained except for security fixes. New +// applications should consider a more focused, modern alternative to OpenPGP +// for their specific task. If you are required to interoperate with OpenPGP +// systems and need a maintained package, consider a maintained community fork. +// See https://golang.org/issue/37497. package armor // import "golang.org/x/crypto/openpgp/armor" import ( diff --git a/openpgp/clearsign/clearsign.go b/openpgp/clearsign/clearsign.go index c360460..b0ede27 100644 --- a/openpgp/clearsign/clearsign.go +++ b/openpgp/clearsign/clearsign.go @@ -7,6 +7,12 @@ // // Clearsigned messages are cryptographically signed, but the contents of the // message are kept in plaintext so that it can be read without special tools. +// +// Deprecated: this package is unmaintained except for security fixes. New +// applications should consider a more focused, modern alternative to OpenPGP +// for their specific task. If you are required to interoperate with OpenPGP +// systems and need a maintained package, consider a maintained community fork. +// See https://golang.org/issue/37497. package clearsign // import "golang.org/x/crypto/openpgp/clearsign" import ( diff --git a/openpgp/elgamal/elgamal.go b/openpgp/elgamal/elgamal.go index 72a6a73..84396a0 100644 --- a/openpgp/elgamal/elgamal.go +++ b/openpgp/elgamal/elgamal.go @@ -10,6 +10,12 @@ // This form of ElGamal embeds PKCS#1 v1.5 padding, which may make it // unsuitable for other protocols. RSA should be used in preference in any // case. +// +// Deprecated: this package was only provided to support ElGamal encryption in +// OpenPGP. The golang.org/x/crypto/openpgp package is now deprecated (see +// https://golang.org/issue/44226), and ElGamal in the OpenPGP ecosystem has +// compatibility and security issues (see https://eprint.iacr.org/2021/923). +// Moreover, this package doesn't protect against side-channel attacks. package elgamal // import "golang.org/x/crypto/openpgp/elgamal" import ( diff --git a/openpgp/errors/errors.go b/openpgp/errors/errors.go index eb0550b..8a34b5a 100644 --- a/openpgp/errors/errors.go +++ b/openpgp/errors/errors.go @@ -3,6 +3,12 @@ // license that can be found in the LICENSE file. // Package errors contains common error types for the OpenPGP packages. +// +// Deprecated: this package is unmaintained except for security fixes. New +// applications should consider a more focused, modern alternative to OpenPGP +// for their specific task. If you are required to interoperate with OpenPGP +// systems and need a maintained package, consider a maintained community fork. +// See https://golang.org/issue/37497. package errors // import "golang.org/x/crypto/openpgp/errors" import ( diff --git a/openpgp/packet/packet.go b/openpgp/packet/packet.go index 9728d61..23c3826 100644 --- a/openpgp/packet/packet.go +++ b/openpgp/packet/packet.go @@ -4,6 +4,12 @@ // Package packet implements parsing and serialization of OpenPGP packets, as // specified in RFC 4880. +// +// Deprecated: this package is unmaintained except for security fixes. New +// applications should consider a more focused, modern alternative to OpenPGP +// for their specific task. If you are required to interoperate with OpenPGP +// systems and need a maintained package, consider a maintained community fork. +// See https://golang.org/issue/37497. package packet // import "golang.org/x/crypto/openpgp/packet" import ( diff --git a/openpgp/read.go b/openpgp/read.go index 6ec664f..7052d94 100644 --- a/openpgp/read.go +++ b/openpgp/read.go @@ -3,6 +3,12 @@ // license that can be found in the LICENSE file. // Package openpgp implements high level operations on OpenPGP messages. +// +// Deprecated: this package is unmaintained except for security fixes. New +// applications should consider a more focused, modern alternative to OpenPGP +// for their specific task. If you are required to interoperate with OpenPGP +// systems and need a maintained package, consider a maintained community fork. +// See https://golang.org/issue/37497. package openpgp // import "golang.org/x/crypto/openpgp" import ( diff --git a/openpgp/s2k/s2k.go b/openpgp/s2k/s2k.go index 4b9a44c..bd637ad 100644 --- a/openpgp/s2k/s2k.go +++ b/openpgp/s2k/s2k.go @@ -4,6 +4,12 @@ // Package s2k implements the various OpenPGP string-to-key transforms as // specified in RFC 4800 section 3.7.1. +// +// Deprecated: this package is unmaintained except for security fixes. New +// applications should consider a more focused, modern alternative to OpenPGP +// for their specific task. If you are required to interoperate with OpenPGP +// systems and need a maintained package, consider a maintained community fork. +// See https://golang.org/issue/37497. package s2k // import "golang.org/x/crypto/openpgp/s2k" import (