From d9474cc4853d9ef1a29356975408d4771e5770c6 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Wed, 24 Jun 2026 17:41:52 -0700 Subject: [PATCH] openpgp: make the deprecation message more explicit The package is unmaintained, unsafe at any speed, and does not receive security fixes. Document that, and point at the ProtonMail fork for those that _must_ still use OpenPGP. Change-Id: Ia602eaaf9e08bd25389400ebe7f346b60bdb9d99 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/794200 Auto-Submit: Roland Shoemaker LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com Reviewed-by: Damien Neil --- openpgp/armor/armor.go | 11 ++++++----- openpgp/clearsign/clearsign.go | 11 ++++++----- openpgp/errors/errors.go | 11 ++++++----- openpgp/packet/packet.go | 11 ++++++----- openpgp/read.go | 11 ++++++----- openpgp/s2k/s2k.go | 11 ++++++----- 6 files changed, 36 insertions(+), 30 deletions(-) diff --git a/openpgp/armor/armor.go b/openpgp/armor/armor.go index e664d12..453e481 100644 --- a/openpgp/armor/armor.go +++ b/openpgp/armor/armor.go @@ -5,11 +5,12 @@ // Package armor implements OpenPGP ASCII Armor, see RFC 4880. OpenPGP Armor is // very similar to PEM except that it has an additional CRC checksum. // -// Deprecated: this package is unmaintained except for security fixes. New -// applications should consider a more focused, modern alternative to OpenPGP -// for their specific task. If you are required to interoperate with OpenPGP -// systems and need a maintained package, consider a community fork. -// See https://golang.org/issue/44226. +// Deprecated: this package is unsafe by design, and has numerous known security +// issues. It is not maintained, and should not be used. New applications should +// consider a more focused, modern alternative to OpenPGP for their specific +// task. If you are required to interoperate with OpenPGP systems and need a +// maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which +// is a maintained fork that aims to be a drop-in replacement for this package. package armor import ( diff --git a/openpgp/clearsign/clearsign.go b/openpgp/clearsign/clearsign.go index cea48ef..cbd2e5d 100644 --- a/openpgp/clearsign/clearsign.go +++ b/openpgp/clearsign/clearsign.go @@ -8,11 +8,12 @@ // Clearsigned messages are cryptographically signed, but the contents of the // message are kept in plaintext so that it can be read without special tools. // -// Deprecated: this package is unmaintained except for security fixes. New -// applications should consider a more focused, modern alternative to OpenPGP -// for their specific task. If you are required to interoperate with OpenPGP -// systems and need a maintained package, consider a community fork. -// See https://golang.org/issue/44226. +// Deprecated: this package is unsafe by design, and has numerous known security +// issues. It is not maintained, and should not be used. New applications should +// consider a more focused, modern alternative to OpenPGP for their specific +// task. If you are required to interoperate with OpenPGP systems and need a +// maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which +// is a maintained fork that aims to be a drop-in replacement for this package. package clearsign import ( diff --git a/openpgp/errors/errors.go b/openpgp/errors/errors.go index a328749..2009e2a 100644 --- a/openpgp/errors/errors.go +++ b/openpgp/errors/errors.go @@ -4,11 +4,12 @@ // Package errors contains common error types for the OpenPGP packages. // -// Deprecated: this package is unmaintained except for security fixes. New -// applications should consider a more focused, modern alternative to OpenPGP -// for their specific task. If you are required to interoperate with OpenPGP -// systems and need a maintained package, consider a community fork. -// See https://golang.org/issue/44226. +// Deprecated: this package is unsafe by design, and has numerous known security +// issues. It is not maintained, and should not be used. New applications should +// consider a more focused, modern alternative to OpenPGP for their specific +// task. If you are required to interoperate with OpenPGP systems and need a +// maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which +// is a maintained fork that aims to be a drop-in replacement for this package. package errors import ( diff --git a/openpgp/packet/packet.go b/openpgp/packet/packet.go index a84a1a2..5e3a25a 100644 --- a/openpgp/packet/packet.go +++ b/openpgp/packet/packet.go @@ -5,11 +5,12 @@ // Package packet implements parsing and serialization of OpenPGP packets, as // specified in RFC 4880. // -// Deprecated: this package is unmaintained except for security fixes. New -// applications should consider a more focused, modern alternative to OpenPGP -// for their specific task. If you are required to interoperate with OpenPGP -// systems and need a maintained package, consider a community fork. -// See https://golang.org/issue/44226. +// Deprecated: this package is unsafe by design, and has numerous known security +// issues. It is not maintained, and should not be used. New applications should +// consider a more focused, modern alternative to OpenPGP for their specific +// task. If you are required to interoperate with OpenPGP systems and need a +// maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which +// is a maintained fork that aims to be a drop-in replacement for this package. package packet import ( diff --git a/openpgp/read.go b/openpgp/read.go index cff3db9..28905a9 100644 --- a/openpgp/read.go +++ b/openpgp/read.go @@ -4,11 +4,12 @@ // Package openpgp implements high level operations on OpenPGP messages. // -// Deprecated: this package is unmaintained except for security fixes. New -// applications should consider a more focused, modern alternative to OpenPGP -// for their specific task. If you are required to interoperate with OpenPGP -// systems and need a maintained package, consider a community fork. -// See https://golang.org/issue/44226. +// Deprecated: this package is unsafe by design, and has numerous known security +// issues. It is not maintained, and should not be used. New applications should +// consider a more focused, modern alternative to OpenPGP for their specific +// task. If you are required to interoperate with OpenPGP systems and need a +// maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which +// is a maintained fork that aims to be a drop-in replacement for this package. package openpgp import ( diff --git a/openpgp/s2k/s2k.go b/openpgp/s2k/s2k.go index 490cb63..b5fe4c1 100644 --- a/openpgp/s2k/s2k.go +++ b/openpgp/s2k/s2k.go @@ -5,11 +5,12 @@ // Package s2k implements the various OpenPGP string-to-key transforms as // specified in RFC 4800 section 3.7.1. // -// Deprecated: this package is unmaintained except for security fixes. New -// applications should consider a more focused, modern alternative to OpenPGP -// for their specific task. If you are required to interoperate with OpenPGP -// systems and need a maintained package, consider a community fork. -// See https://golang.org/issue/44226. +// Deprecated: this package is unsafe by design, and has numerous known security +// issues. It is not maintained, and should not be used. New applications should +// consider a more focused, modern alternative to OpenPGP for their specific +// task. If you are required to interoperate with OpenPGP systems and need a +// maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which +// is a maintained fork that aims to be a drop-in replacement for this package. package s2k import (