go.mod: update golang.org/x dependencies

Update golang.org/x dependencies to their latest tagged versions.

Change-Id: Ia33bd1cd73db091960b285c234d2cf2622f30943
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/764501
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

acme/autocert/autocert.go

@@ -248,10 +248,6 @@ func (m *Manager) TLSConfig() *tls.Config {
 // If GetCertificate is used directly, instead of via Manager.TLSConfig, package users will
 // also have to add acme.ALPNProto to NextProtos for tls-alpn-01, or use HTTPHandler for http-01.
 func (m *Manager) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	if m.Prompt == nil {
-		return nil, errors.New("acme/autocert: Manager.Prompt not set")
-	}
-
 	name := hello.ServerName
 	if name == "" {
 		return nil, errors.New("acme/autocert: missing server name")

acme/autocert/autocert_test.go

@@ -201,7 +201,7 @@ func TestGetCertificate(t *testing.T) {
 			prepare: func(t *testing.T, man *Manager, s *acmetest.CAServer) {
 				man.Prompt = nil
 			},
-			expectError: "Manager.Prompt not set",
+			expectError: "missing Manager.Prompt",
 		},
 		{
 			name:   "trailingDot",

acme/autocert/internal/acmetest/ca.go

@@ -239,7 +239,8 @@ type discovery struct {
 }
 
 type discoveryMeta struct {
-	ExternalAccountRequired bool `json:"externalAccountRequired,omitempty"`
+	Terms                   string `json:"termsOfService,omitempty"`
+	ExternalAccountRequired bool   `json:"externalAccountRequired,omitempty"`
 }
 
 type challenge struct {
@@ -281,6 +282,7 @@ func (ca *CAServer) handle(w http.ResponseWriter, r *http.Request) {
 			NewAccount: ca.serverURL("/new-account"),
 			NewOrder:   ca.serverURL("/new-order"),
 			Meta: discoveryMeta{
+				Terms:                   ca.serverURL("/terms"),
 				ExternalAccountRequired: ca.eabRequired,
 			},
 		}

acme/autocert/renewal_test.go

@@ -180,9 +180,6 @@ func TestRenewFromCacheAlreadyRenewed(t *testing.T) {
 
 	// set internal state to an almost expired cert
 	oldCert := ca.LeafCert(exampleDomain, "ECDSA", now.Add(-2*time.Hour), now.Add(time.Minute))
-	if err != nil {
-		t.Fatal(err)
-	}
 	oldLeaf, err := validCert(exampleCertKey, oldCert.Certificate, oldCert.PrivateKey.(crypto.Signer), now)
 	if err != nil {
 		t.Fatal(err)

acme/rfc8555.go

@@ -53,6 +53,9 @@ func (c *Client) registerRFC(ctx context.Context, acct *Account, prompt func(tos
 		Contact: acct.Contact,
 	}
 	if c.dir.Terms != "" {
+		if prompt == nil {
+			return nil, errors.New("acme: missing Manager.Prompt to accept server's terms of service")
+		}
 		req.TermsAgreed = prompt(c.dir.Terms)
 	}
 

chacha20poly1305/chacha20poly1305.go

@@ -38,6 +38,9 @@ type chacha20poly1305 struct {
 
 // New returns a ChaCha20-Poly1305 AEAD that uses the given 256-bit key.
 func New(key []byte) (cipher.AEAD, error) {
+	if fips140Enforced() {
+		return nil, errors.New("chacha20poly1305: use of ChaCha20Poly1305 is not allowed in FIPS 140-only mode")
+	}
 	if len(key) != KeySize {
 		return nil, errors.New("chacha20poly1305: bad key length")
 	}

chacha20poly1305/fips140only_compat.go

@@ -0,0 +1,9 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.26
+
+package chacha20poly1305
+
+func fips140Enforced() bool { return false }

chacha20poly1305/fips140only_go1.26.go

@@ -0,0 +1,11 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.26
+
+package chacha20poly1305
+
+import "crypto/fips140"
+
+func fips140Enforced() bool { return fips140.Enforced() }

chacha20poly1305/xchacha20poly1305.go

@@ -22,6 +22,9 @@ type xchacha20poly1305 struct {
 // preferred when nonce uniqueness cannot be trivially ensured, or whenever
 // nonces are randomly generated.
 func NewX(key []byte) (cipher.AEAD, error) {
+	if fips140Enforced() {
+		return nil, errors.New("chacha20poly1305: use of ChaCha20Poly1305 is not allowed in FIPS 140-only mode")
+	}
 	if len(key) != KeySize {
 		return nil, errors.New("chacha20poly1305: bad key length")
 	}

go.mod

@@ -1,11 +1,11 @@
 module golang.org/x/crypto
 
-go 1.24.0
+go 1.25.0
 
 require (
-	golang.org/x/net v0.47.0 // tagx:ignore
-	golang.org/x/sys v0.39.0
-	golang.org/x/term v0.38.0
+	golang.org/x/net v0.52.0 // tagx:ignore
+	golang.org/x/sys v0.43.0
+	golang.org/x/term v0.42.0
 )
 
-require golang.org/x/text v0.32.0 // indirect
+require golang.org/x/text v0.36.0 // indirect

go.sum

@@ -1,8 +1,8 @@
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

scrypt/scrypt.go

@@ -196,6 +196,9 @@ func Key(password, salt []byte, N, r, p, keyLen int) ([]byte, error) {
 	if N <= 1 || N&(N-1) != 0 {
 		return nil, errors.New("scrypt: N must be > 1 and a power of 2")
 	}
+	if r <= 0 || p <= 0 {
+		return nil, errors.New("scrypt: parameters must be > 0")
+	}
 	if uint64(r)*uint64(p) >= 1<<30 || r > maxInt/128/p || r > maxInt/256 || N > maxInt/128/r {
 		return nil, errors.New("scrypt: parameters are too large")
 	}

scrypt/scrypt_test.go

@@ -133,6 +133,10 @@ var bad = []testVector{
 	{"p", "s", 1, 1, 1, nil},                    // N == 1
 	{"p", "s", 7, 8, 1, nil},                    // N is not power of 2
 	{"p", "s", 16, maxInt / 2, maxInt / 2, nil}, // p * r too large
+	{"p", "s", 2, 0, 1, nil},                    // r too small
+	{"p", "s", 2, 1, 0, nil},                    // p too small
+	{"p", "s", 2, -1, 1, nil},                   // r is negative
+	{"p", "s", 2, 1, -1, nil},                   // p is negative
 }
 
 func TestKey(t *testing.T) {

ssh/agent/server.go

@@ -36,7 +36,7 @@ func (s *server) processRequestBytes(reqData []byte) []byte {
 		return []byte{agentFailure}
 	}
 
-	if err == nil && rep == nil {
+	if rep == nil {
 		return []byte{agentSuccess}
 	}
 

ssh/certs_test.go

@@ -330,10 +330,6 @@ func TestCertTypes(t *testing.T) {
 			go NewServerConn(c1, conf)
 
 			priv := m.signer
-			if err != nil {
-				t.Fatalf("error generating ssh pubkey: %v", err)
-			}
-
 			cert := &Certificate{
 				CertType: UserCert,
 				Key:      priv.PublicKey(),

ssh/cipher.go

@@ -586,7 +586,7 @@ func (c *cbcCipher) writeCipherPacket(seqNum uint32, w io.Writer, rand io.Reader
 
 	// Length of encrypted portion of the packet (header, payload, padding).
 	// Enforce minimum padding and packet size.
-	encLength := maxUInt32(prefixLen+len(packet)+cbcMinPaddingSize, cbcMinPaddingSize)
+	encLength := maxUInt32(prefixLen+len(packet)+cbcMinPaddingSize, cbcMinPacketSize)
 	// Enforce block size.
 	encLength = (encLength + effectiveBlockSize - 1) / effectiveBlockSize * effectiveBlockSize
 

ssh/client_auth.go

@@ -274,10 +274,14 @@ func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (MultiA
 	}
 
 	// Filter algorithms based on those supported by MultiAlgorithmSigner.
+	// Iterate over the signer's algorithms first to preserve its preference order.
+	supportedKeyAlgos := algorithmsForKeyFormat(keyFormat)
 	var keyAlgos []string
-	for _, algo := range algorithmsForKeyFormat(keyFormat) {
-		if slices.Contains(as.Algorithms(), underlyingAlgo(algo)) {
-			keyAlgos = append(keyAlgos, algo)
+	for _, signerAlgo := range as.Algorithms() {
+		if idx := slices.IndexFunc(supportedKeyAlgos, func(algo string) bool {
+			return underlyingAlgo(algo) == signerAlgo
+		}); idx >= 0 {
+			keyAlgos = append(keyAlgos, supportedKeyAlgos[idx])
 		}
 	}
 

ssh/client_auth_test.go

@@ -1159,6 +1159,52 @@ func TestPickSignatureAlgorithm(t *testing.T) {
 	}
 }
 
+func TestPickSignatureAlgorithmRespectsSignerPreference(t *testing.T) {
+	algoSigner, ok := testSigners["rsa"].(AlgorithmSigner)
+	if !ok {
+		t.Fatalf("rsa test signer does not implement the AlgorithmSigner interface")
+	}
+
+	serverExtensions := map[string][]byte{
+		"server-sig-algs": []byte(KeyAlgoRSASHA256 + "," + KeyAlgoRSASHA512),
+	}
+
+	tests := []struct {
+		name         string
+		signerPrefs  []string
+		expectedAlgo string
+	}{
+		{
+			name:         "Signer prefers SHA512 then SHA256",
+			signerPrefs:  []string{KeyAlgoRSASHA512, KeyAlgoRSASHA256},
+			expectedAlgo: KeyAlgoRSASHA512,
+		},
+		{
+			name:         "Signer prefers SHA256 then SHA512",
+			signerPrefs:  []string{KeyAlgoRSASHA256, KeyAlgoRSASHA512},
+			expectedAlgo: KeyAlgoRSASHA256,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			orderedSigner, err := NewSignerWithAlgorithms(algoSigner, tc.signerPrefs)
+			if err != nil {
+				t.Fatalf("failed to create ordered signer: %v", err)
+			}
+
+			_, selectedAlgo, err := pickSignatureAlgorithm(orderedSigner, serverExtensions)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if selectedAlgo != tc.expectedAlgo {
+				t.Errorf("Algorithm mismatch; got %q want %q", selectedAlgo, tc.expectedAlgo)
+			}
+		})
+	}
+}
+
 // configurablePublicKeyCallback is a public key callback that allows to
 // configure the signature algorithm and format. This way we can emulate the
 // behavior of buggy clients.

x509roots/fallback/bundle/bundle.go

@@ -797,77 +797,83 @@ var unparsedCertificates = []unparsedCertificate{
 		certStartOff: 139995,
 		certLength:   580,
 	},
+	{
+		cn:           "CN=e-Szigno TLS Root CA 2023,O=Microsec Ltd.,L=Budapest,C=HU,2.5.4.97=#130e56415448552d3233353834343937",
+		sha256Hash:   "b49141502d00663d740f2e7ec340c52800962666121a36d09cf7dd2b90384fb4",
+		certStartOff: 140575,
+		certLength:   723,
+	},
 	{
 		cn:           "CN=emSign ECC Root CA - C3,OU=emSign PKI,O=eMudhra Inc,C=US",
 		sha256Hash:   "bc4d809b15189d78db3e1d8cf4f9726a795da1643ca5f1358e1ddb0edc0d7eb3",
-		certStartOff: 140575,
+		certStartOff: 141298,
 		certLength:   559,
 	},
 	{
 		cn:           "CN=emSign ECC Root CA - G3,OU=emSign PKI,O=eMudhra Technologies Limited,C=IN",
 		sha256Hash:   "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
-		certStartOff: 141134,
+		certStartOff: 141857,
 		certLength:   594,
 	},
 	{
 		cn:           "CN=emSign Root CA - C1,OU=emSign PKI,O=eMudhra Inc,C=US",
 		sha256Hash:   "125609aa301da0a249b97a8239cb6a34216f44dcac9f3954b14292f2e8c8608f",
-		certStartOff: 141728,
+		certStartOff: 142451,
 		certLength:   887,
 	},
 	{
 		cn:           "CN=emSign Root CA - G1,OU=emSign PKI,O=eMudhra Technologies Limited,C=IN",
 		sha256Hash:   "40f6af0346a99aa1cd1d555a4e9cce62c7f9634603ee406615833dc8c8d00367",
-		certStartOff: 142615,
+		certStartOff: 143338,
 		certLength:   920,
 	},
 	{
 		cn:           "CN=vTrus ECC Root CA,O=iTrusChina Co.\\,Ltd.,C=CN",
 		sha256Hash:   "30fbba2c32238e2a98547af97931e550428b9b3f1c8eeb6633dcfa86c5b27dd3",
-		certStartOff: 143535,
+		certStartOff: 144258,
 		certLength:   531,
 	},
 	{
 		cn:           "CN=vTrus Root CA,O=iTrusChina Co.\\,Ltd.,C=CN",
 		sha256Hash:   "8a71de6559336f426c26e53880d00d88a18da4c6a91f0dcb6194e206c5c96387",
-		certStartOff: 144066,
+		certStartOff: 144789,
 		certLength:   1370,
 	},
 	{
 		cn:           "OU=AC RAIZ FNMT-RCM,O=FNMT-RCM,C=ES",
 		sha256Hash:   "ebc5570c29018c4d67b1aa127baf12f703b4611ebc17b7dab5573894179b93fa",
-		certStartOff: 145436,
+		certStartOff: 146159,
 		certLength:   1415,
 	},
 	{
 		cn:           "OU=Security Communication RootCA2,O=SECOM Trust Systems CO.\\,LTD.,C=JP",
 		sha256Hash:   "513b2cecb810d4cde5dd85391adfc6c2dd60d87bb736d2b521484aa47a0ebef6",
-		certStartOff: 146851,
+		certStartOff: 147574,
 		certLength:   891,
 	},
 	{
 		cn:           "OU=certSIGN ROOT CA G2,O=CERTSIGN SA,C=RO",
 		sha256Hash:   "657cfe2fa73faa38462571f332a2363a46fce7020951710702cdfbb6eeda3305",
-		certStartOff: 147742,
+		certStartOff: 148465,
 		certLength:   1355,
 	},
 	{
 		cn:           "OU=certSIGN ROOT CA,O=certSIGN,C=RO",
 		sha256Hash:   "eaa962c4fa4a6bafebe415196d351ccd888d4f53f3fa8ae6d7c466a94e6042bb",
-		certStartOff: 149097,
+		certStartOff: 149820,
 		certLength:   828,
 	},
 	{
 		cn:            "OU=ePKI Root Certification Authority,O=Chunghwa Telecom Co.\\, Ltd.,C=TW",
 		sha256Hash:    "c0a6f4dc63a24bfdcf54ef2a6a082a0a72de35803e2ff5ff527ae5d87206dfd5",
-		certStartOff:  149925,
+		certStartOff:  150648,
 		certLength:    1460,
 		distrustAfter: "2025-04-15T23:59:59Z",
 	},
 	{
 		cn:           "SERIALNUMBER=G63287510,CN=ANF Secure Server Root CA,OU=ANF CA Raiz,O=ANF Autoridad de Certificacion,C=ES",
 		sha256Hash:   "fb8fec759169b9106b1e511644c618c51304373f6c0643088d8beffd1b997599",
-		certStartOff: 151385,
+		certStartOff: 152108,
 		certLength:   1523,
 	},
 }

x509roots/fallback/go.mod

@@ -1,3 +1,3 @@
 module golang.org/x/crypto/x509roots/fallback
 
-go 1.24.0
+go 1.25.0