INCOMPATIBLE: Replace golang.org/x/crypto/openpgp

... with github.com/ProtonMail/go-crypto/openpgp

x/crypto/openpgp now contains a stronger deprecation warning:
> // Deprecated: this package is unsafe by design, and has numerous known security
> // issues. It is not maintained, and should not be used.

and points at github.com/ProtonMail/go-crypto/openpgp , so use that one.

That is an INCOMPATIBLE change in that this implementation completely removes
support for v3 signature packets (but we retain support for them with the
other mechanism implementations).

We can also remove the SigLifetimeSecs code because that is automatically
enforced now (but we keep the expired-signature test).

This currently adds an entirely new copy because ocicrypt
still uses x/crypto, hopefully that can migrate as well.
(But, still, this adds support for various algorithms that _are_
a long-term net new code.)

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Author: mtrmac

image/go.mod

@@ -8,6 +8,7 @@ go 1.25.7
 require (
 	dario.cat/mergo v1.0.2
 	github.com/BurntSushi/toml v1.6.0
+	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01
 	github.com/containers/ocicrypt v1.3.1
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467
@@ -39,7 +40,6 @@ require (
 	go.etcd.io/bbolt v1.5.0
 	go.podman.io/storage v1.63.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/crypto v0.54.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/term v0.45.0
@@ -53,6 +53,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
@@ -96,6 +97,7 @@ require (
 	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.40.0 // indirect

image/go.sum

@@ -6,6 +6,8 @@ github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -23,6 +25,8 @@ github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=

image/signature/mechanism.go

@@ -9,12 +9,7 @@ import (
 	"io"
 	"strings"
 
-	// This code is used only to parse the data in an explicitly-untrusted
-	// code path, where cryptography is not relevant. For now, continue to
-	// use this frozen deprecated implementation. When mechanism_openpgp.go
-	// migrates to another implementation, this should migrate as well.
-	//lint:ignore SA1019 See above
-	"golang.org/x/crypto/openpgp" //nolint:staticcheck
+	"github.com/ProtonMail/go-crypto/openpgp"
 )
 
 // SigningMechanism abstracts a way to sign binary blobs and verify their signatures.

image/signature/mechanism_openpgp.go

@@ -10,22 +10,13 @@ import (
 	"os"
 	"path"
 	"strings"
-	"time"
 
+	"github.com/ProtonMail/go-crypto/openpgp"
 	"go.podman.io/image/v5/signature/internal"
 	"go.podman.io/storage/pkg/homedir"
-
-	// This is a fallback code; the primary recommendation is to use the gpgme mechanism
-	// implementation, which is out-of-process and more appropriate for handling long-term private key material
-	// than any Go implementation.
-	// For this verify-only fallback, we haven't reviewed any of the
-	// existing alternatives to choose; so, for now, continue to
-	// use this frozen deprecated implementation.
-	//lint:ignore SA1019 See above
-	"golang.org/x/crypto/openpgp" //nolint:staticcheck
 )
 
-// A GPG/OpenPGP signing mechanism, implemented using x/crypto/openpgp.
+// A GPG/OpenPGP signing mechanism, implemented using github.com/ProtonMail/go-crypto/openpgp.
 type openpgpSigningMechanism struct {
 	keyring openpgp.EntityList
 }
@@ -155,18 +146,6 @@ func (m *openpgpSigningMechanism) Verify(unverifiedSignature []byte) (contents [
 	if md.SignedBy == nil {
 		return nil, "", internal.NewInvalidSignatureError(fmt.Sprintf("Key not found for key ID %x in signature", md.SignedByKeyId))
 	}
-	if md.Signature != nil {
-		if md.Signature.SigLifetimeSecs != nil {
-			expiry := md.Signature.CreationTime.Add(time.Duration(*md.Signature.SigLifetimeSecs) * time.Second)
-			if time.Now().After(expiry) {
-				return nil, "", internal.NewInvalidSignatureError(fmt.Sprintf("Signature expired on %s", expiry))
-			}
-		}
-	} else if md.SignatureV3 == nil {
-		// Coverage: If md.SignedBy != nil, the final md.UnverifiedBody.Read() either sets one of md.Signature or md.SignatureV3,
-		// or sets md.SignatureError.
-		return nil, "", internal.NewInvalidSignatureError("Unexpected openpgp.MessageDetails: neither Signature nor SignatureV3 is set")
-	}
 
 	// Uppercase the fingerprint to be compatible with gpgme
 	return content, strings.ToUpper(fmt.Sprintf("%x", md.SignedBy.Entity.PrimaryKey.Fingerprint)), nil

image/signature/mechanism_test.go

@@ -17,7 +17,8 @@ const (
 	testGPGHomeDirectory = "./fixtures"
 )
 
-// Many of the tests use two fixtures: V4 signature packets (*.signature), and V3 signature packets (*.signature-v3)
+// Many of the tests use two fixtures: V4 signature packets (*.signature), and V3 signature packets (*.signature-v3).
+// Note that V3 signature packets are not supported by openpgpSigningMechanism.
 
 type fixtureVariant struct {
 	path  string
@@ -103,7 +104,9 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
 	defer mech.Close()
 	for _, variant := range signatures {
 		_, _, err := mech.Verify(variant.bytes)
-		assert.NoError(t, err, variant.path)
+		if !variant.isV3 { // V3 signatures might be entirely unsupported and rejected.
+			assert.NoError(t, err, variant.path)
+		}
 	}
 
 	// If we use the default directory mechanism, GNUPGHOME is respected.
@@ -113,7 +116,9 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
 	defer mech.Close()
 	for _, variant := range signatures {
 		_, _, err := mech.Verify(variant.bytes)
-		assert.NoError(t, err, variant.path)
+		if !variant.isV3 { // V3 signatures might be entirely unsupported and rejected.
+			assert.NoError(t, err, variant.path)
+		}
 	}
 }
 
@@ -140,9 +145,13 @@ func TestNewEphemeralGPGSigningMechanism(t *testing.T) {
 	// After import, the signature should validate.
 	for _, variant := range signatures {
 		content, signingFingerprint, err := mech.Verify(variant.bytes)
-		require.NoError(t, err, variant.path)
-		assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
-		assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant.path)
+		if !variant.isV3 { // V3 signatures might be entirely unsupported and rejected.
+			require.NoError(t, err, variant.path)
+		}
+		if err == nil {
+			assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
+			assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant.path)
+		}
 	}
 
 	// Import of a key with a subkey
@@ -248,34 +257,46 @@ func TestGPGSigningMechanismVerify(t *testing.T) {
 	require.NoError(t, err)
 	defer mech.Close()
 
+	// For extra paranoia, test that we return nil data on error.
+
 	// Successful verification
 	signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
 	for _, variant := range signatures {
 		content, signingFingerprint, err := mech.Verify(variant.bytes)
-		require.NoError(t, err, variant.path)
-		assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
-		assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant.path)
+		if !variant.isV3 { // V3 signatures might be entirely unsupported and rejected.
+			require.NoError(t, err, variant.path)
+		}
+		if err == nil {
+			assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
+			assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant.path)
+		} else {
+			assertSigningError(t, content, signingFingerprint, err)
+		}
 	}
 	// Successful verification of a signature using a subkey
 	signatures = fixtureVariants(t, "./fixtures/subkey.signature")
 	for _, variant := range signatures {
 		content, signingFingerprint, err := mech.Verify(variant.bytes)
-		require.NoError(t, err, variant.path)
-		assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest:latest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{}}`), content, variant.path)
-		if signingFingerprint != TestKeyFingerprintPrimaryWithSubkey {
-			assert.Equal(t, TestKeyFingerprintSubkeyWithSubkey, signingFingerprint, variant.path)
-			withLookup, ok := mech.(signingMechanismWithVerificationIdentityLookup)
-			require.True(t, ok, variant.path)
-
-			primaryKey, err := withLookup.keyIdentityForVerificationKeyIdentity(signingFingerprint)
+		if !variant.isV3 { // V3 signatures might be entirely unsupported and rejected.
 			require.NoError(t, err, variant.path)
-			signingFingerprint = primaryKey
 		}
-		assert.Equal(t, TestKeyFingerprintPrimaryWithSubkey, signingFingerprint, variant.path)
+		if err == nil {
+			assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest:latest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{}}`), content, variant.path)
+			if signingFingerprint != TestKeyFingerprintPrimaryWithSubkey {
+				assert.Equal(t, TestKeyFingerprintSubkeyWithSubkey, signingFingerprint, variant.path)
+				withLookup, ok := mech.(signingMechanismWithVerificationIdentityLookup)
+				require.True(t, ok, variant.path)
+
+				primaryKey, err := withLookup.keyIdentityForVerificationKeyIdentity(signingFingerprint)
+				require.NoError(t, err, variant.path)
+				signingFingerprint = primaryKey
+			}
+			assert.Equal(t, TestKeyFingerprintPrimaryWithSubkey, signingFingerprint, variant.path)
+		} else {
+			assertSigningError(t, content, signingFingerprint, err)
+		}
 	}
 
-	// For extra paranoia, test that we return nil data on error.
-
 	// Completely invalid signature.
 	content, signingFingerprint, err := mech.Verify([]byte{})
 	assertSigningError(t, content, signingFingerprint, err)