[mergeraptor]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ProtonMail/go-crypto	v1.5.1 → v1.5.2

---

Release Notes

ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)

v1.5.2

Compare Source

What's Changed

• fix: Preserve generated RSA key prime ordering in serialization in #​336

Full Changelog: ProtonMail/go-crypto@v1.5.1...v1.5.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[castrojo]

Review of the go-crypto v1.5.1 -> v1.5.2 bump at cf657f6.

• go.sum: go mod download -json github.com/ProtonMail/go-crypto@v1.5.2 returns Sum h1:cucYnvqcY7UOXVD//mSyjeaPY0SSN3v5cDkYPxumINk= and GoModSum h1:/RaSu30DaKO4RY+XdV/ACcCcZkGr7AhUIduq5sjzzCo=, matching both new lines. The stale v1.5.1 lines are gone (cf657f6), so there are no leftover entries.
• Upstream delta (compare v1.5.1...v1.5.2): one fix, ProtonMail/go-crypto#336 "Preserve generated RSA key prime ordering in serialization", touching only openpgp/key_generation.go, openpgp/v2/key_generation.go and openpgp/packet/private_key.go plus tests.
• knuckle's use is verify-only: internal/bakery/verify.go calls openpgp.ReadArmoredKeyRing, clearsign.Decode and openpgp.CheckDetachedSignature. It never generates or serializes private keys at runtime, so the changed code path is not reached by production code.
• All required checks pass at head: build + test (-race), coverage gate, golangci-lint, govulncheck, CodeQL, dependency-review, headless ISO boot smoke, headless e2e (dry-run), cross-compile arm64, bats, shellcheck.

No issues found.

[mergeraptor]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[Danathar]

Patch bump of go-crypto (v1.5.1 to v1.5.2), go.mod and go.sum only. I checked the new hashes against a fresh go mod download and they match, go mod tidy -diff is clean, and go build and go test ./internal/bakery/... pass. knuckle only uses go-crypto to verify signatures; the upstream fix touches key generation and serialization. All 12 checks pass. Renovate will no longer rebase this branch because of the extra go.sum commit, so it needs a manual merge. knuckle needs two approvals.

[Danathar]

@castrojo, your 09-29 review at cf657f6 checked the go.sum hashes and the upstream delta, and found the change doesn't touch knuckle's verify-only use. Was anything in it meant to block? If not, could you approve it? knuckle needs two approvals and this has only mine. Renovate won't rebase it because of the extra go.sum commit, so it'll need a manual merge.