feat(deps): bump github.com/ProtonMail/gopenpgp/v2 from 2.2.2 to 2.4.6

[dependabot]

Bumps github.com/ProtonMail/gopenpgp/v2 from 2.2.2 to 2.4.6.

Release notes

Sourced from github.com/ProtonMail/gopenpgp/v2's releases.

Release version 2.4.6

Fix MIME signature parsing issues

Release version 2.4.5

Deprecate SeparateKeyAndData, replace with (msg *PGPMessage) SplitMessage() to split PGP messages

Release version 2.4.4

Clone returned slices from SeparateKeyAndData

Release version 2.4.3

Security

• Fixed incorrect MDC parsing for session key decryption

Changed

• SeparateKeyAndData is now implemented in a more generic way, by checking for the location in the bytes of the last session key packet, then splitting the binary message after that point.

Fixed

• SeparateKeyAndData now correctly parses AEAD packets.
• (ap *AttachmentProcessor) Finish() now returns encryption errors correctly.

Release version 2.4.2

Update underlying crypto library and prevent AEAD messages from being created until the specification is stable

Release version 2.4.1

Fixed bug with NewPGPSplitMessageFromArmored(armored) and PGPMessage.SeparateKeyAndData(). Those functions didn't parse AEAD encrypted messages correctly (eg messages encrypted with the latest versions of gnupg), resulting in a nil DataPacket.

Release version 2.4.0

Update underlying crypto library and add functionality to get the signature timestamp of a verified signature

Release version 2.3.1

Fix the verification of PGP/MIME message signatures:

• Improve the handling of the dual verification status so that it is considered invalid if both embedded and PGP/MIME signatures are invalid.
• start calling callback.OnVerified(status int) to communicate the status verification of the message.

Release version 2.3.0

Added Key.IsRevoked() to check the revocation status of a key and upgraded underlying crypto library to fix handling of revoked keys

Release version 2.2.5

The global pgp variable fields is now protected with a lock and dummy keys are locked and unlocked correctly

Release version 2.2.4

Fixed

• Use the provided verifyTime instead of the current time when verifying embedded signatures.

Release version 2.2.3

Changed

• Keys are now generated with ZLIB as optional compression algorithm
• Upgraded underlying crypto library

Changelog

Sourced from github.com/ProtonMail/gopenpgp/v2's changelog.

[2.4.6] 2022-03-25

Fixed

• Update dependency github.com/ProtonMail/go-mime. It makes the parsing of MIME messages more flexible to messages with no specified charsets.
• Fix the verification of PGP/MIME signature, the signature is now verified against the canonicalized content rather than the raw content.

[2.4.5] 2022-03-01

Added

• (msg *PGPMessage) SplitMessage() to split PGP messages, replacing SeparateKeyAndData.

Changed

• SeparateKeyAndData is now deprecated.

[2.4.4] 2022-02-28

Changed

• SeparateKeyAndData clones the returned byte slices to avoid overwriting.

[2.4.3] 2022-02-24

Security

• Fixed incorrect MDC parsing for session key decryption

Changed

• SeparateKeyAndData is now implemented in a more generic way, by checking for the location in the bytes of the last session key packet, then splitting the binary message after that point.

Fixed

• SeparateKeyAndData now correctly parses AEAD packets.
• (ap *AttachmentProcessor) Finish() now returns encryption errors correctly.

[2.4.2] 2022-01-13

Changed

• Updated underlying crypto library and prevented AEAD messages from being created until the specification is stable

[2.4.1] 2022-01-10

Fixed

• Fixed bug with NewPGPSplitMessageFromArmored(armored) and PGPMessage.SeparateKeyAndData(). Those functions didn't parse AEAD encrypted messages correctly (eg messages encrypted with the latest versions of gnupg), resulting in a nil DataPacket.

[2.4.0] 2021-12-21

Added

• Function to verify a detached signature and get its creation time:

func (keyRing *KeyRing) GetVerifiedSignatureTimestamp(message *PlainMessage, signature *PGPSignature, verifyTime int64) (int64, error)
</tr></table> 

... (truncated)

Commits

• e04eb20 Merge pull request #175 from ProtonMail/release-2.4.6
• c9d7390 Release version 2.4.6
• 095cdcc Merge pull request #172 from ProtonMail/fix/mime-binary-sig-verification
• c9a9f0b Update changelog
• b54b5f4 Fix test data for PGP/MIME tests
• 5c5666e Canonicalize PGP/MIME content before verifying signatures
• 41eb732 Merge pull request #171 from ProtonMail/fix/mime-parsing-unkown-charset
• 0e4303d Update github.com/ProtonMail/go-mime
• 2a30ff6 Release version 2.4.5
• c2d0d4c Merge pull request #170 from ProtonMail/backwards-compat-split-message
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

Merging #484 (192f79f) into main (dfa2f8e) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #484   +/-   ##
=======================================
  Coverage   66.12%   66.12%           
=======================================
  Files          16       16           
  Lines        1916     1916           
=======================================
  Hits         1267     1267           
  Misses        510      510           
  Partials      139      139           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update dfa2f8e...192f79f. Read the comment docs.