Chore(deps): bump github.com/ProtonMail/gopenpgp/v2 from 2.3.0 to 2.4.7

[dependabot]

Bumps github.com/ProtonMail/gopenpgp/v2 from 2.3.0 to 2.4.7.

Release notes

Sourced from github.com/ProtonMail/gopenpgp/v2's releases.

Release version 2.4.7

• DecryptMIMEMessage will return the decrypted content in the OnBody callback, even when there's a signature verification error. That lets the caller decide whether they want to use the content with a warning or hard fail on signature errors.
• Key generation functions no longer return an error if either the name or email is empty

Release version 2.4.6

Fix MIME signature parsing issues

Release version 2.4.5

Deprecate SeparateKeyAndData, replace with (msg *PGPMessage) SplitMessage() to split PGP messages

Release version 2.4.4

Clone returned slices from SeparateKeyAndData

Release version 2.4.3

Security

• Fixed incorrect MDC parsing for session key decryption

Changed

• SeparateKeyAndData is now implemented in a more generic way, by checking for the location in the bytes of the last session key packet, then splitting the binary message after that point.

Fixed

• SeparateKeyAndData now correctly parses AEAD packets.
• (ap *AttachmentProcessor) Finish() now returns encryption errors correctly.

Release version 2.4.2

Update underlying crypto library and prevent AEAD messages from being created until the specification is stable

Release version 2.4.1

Fixed bug with NewPGPSplitMessageFromArmored(armored) and PGPMessage.SeparateKeyAndData(). Those functions didn't parse AEAD encrypted messages correctly (eg messages encrypted with the latest versions of gnupg), resulting in a nil DataPacket.

Release version 2.4.0

Update underlying crypto library and add functionality to get the signature timestamp of a verified signature

Release version 2.3.1

Fix the verification of PGP/MIME message signatures:

• Improve the handling of the dual verification status so that it is considered invalid if both embedded and PGP/MIME signatures are invalid.
• start calling callback.OnVerified(status int) to communicate the status verification of the message.

Changelog

Sourced from github.com/ProtonMail/gopenpgp/v2's changelog.

[2.4.7] 2022-04-27

Changed

• DecryptMIMEMessage will return the decrypted content in the OnBody callback, even when there's a signature verification error. That lets the caller decide whether they want to use the content with a warning or hard fail on signature errors.
• Key generation functions no longer return an error if either the name or email is empty

[2.4.6] 2022-03-25

Fixed

• Update dependency github.com/ProtonMail/go-mime. It makes the parsing of MIME messages more flexible to messages with no specified charsets.
• Fix the verification of PGP/MIME signature, the signature is now verified against the canonicalized content rather than the raw content.

[2.4.5] 2022-03-01

Added

• (msg *PGPMessage) SplitMessage() to split PGP messages, replacing SeparateKeyAndData.

Changed

• SeparateKeyAndData is now deprecated.

[2.4.4] 2022-02-28

Changed

• SeparateKeyAndData clones the returned byte slices to avoid overwriting.

[2.4.3] 2022-02-24

Security

• Fixed incorrect MDC parsing for session key decryption

Changed

• SeparateKeyAndData is now implemented in a more generic way, by checking for the location in the bytes of the last session key packet, then splitting the binary message after that point.

Fixed

• SeparateKeyAndData now correctly parses AEAD packets.
• (ap *AttachmentProcessor) Finish() now returns encryption errors correctly.

[2.4.2] 2022-01-13

Changed

• Updated underlying crypto library and prevented AEAD messages from being created until the specification is stable

[2.4.1] 2022-01-10

Fixed

• Fixed bug with NewPGPSplitMessageFromArmored(armored) and PGPMessage.SeparateKeyAndData(). Those functions didn't parse AEAD encrypted messages correctly (eg messages encrypted with the latest versions of gnupg), resulting in a nil DataPacket.

... (truncated)

Commits

• 8145690 Merge pull request #183 from ProtonMail/release-2.4.7
• 3780a9e Release version 2.4.7
• 74905cd Merge pull request #180 from ProtonMail/keygen-no-name
• f5803d1 Do not return error on empty name or email key generation
• b601b54 Merge pull request #181 from ProtonMail/fix/mime-explicit-verify
• 07e32e3 Update CHANGELOG.md
• 2f59f64 Return decrypted PGP/MIME content with wrong signatures
• 7e0a46f Merge pull request #182 from ProtonMail/fix/ci-issues
• 1184c49 Update github CI
• e04eb20 Merge pull request #175 from ProtonMail/release-2.4.6
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

The following labels could not be found: automation.

[dependabot]

Superseded by #82.