From 6f27de8e4ad65b53013d38b8aacb2d8603410dd0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 19:53:49 +0000 Subject: [PATCH 1/2] Bump the gomod group with 2 updates Bumps the gomod group with 2 updates: [github.com/carabiner-dev/command](https://github.com/carabiner-dev/command) and [github.com/carabiner-dev/signer](https://github.com/carabiner-dev/signer). Updates `github.com/carabiner-dev/command` from 0.3.1 to 0.3.2 - [Release notes](https://github.com/carabiner-dev/command/releases) - [Commits](https://github.com/carabiner-dev/command/compare/v0.3.1...v0.3.2) Updates `github.com/carabiner-dev/signer` from 0.6.1 to 0.6.2 - [Release notes](https://github.com/carabiner-dev/signer/releases) - [Commits](https://github.com/carabiner-dev/signer/compare/v0.6.1...v0.6.2) --- updated-dependencies: - dependency-name: github.com/carabiner-dev/command dependency-version: 0.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/carabiner-dev/signer dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] --- go.mod | 10 +++++----- go.sum | 16 ++++++++-------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/go.mod b/go.mod index 5aceae5..1104a49 100644 --- a/go.mod +++ b/go.mod @@ -1,11 +1,11 @@ module github.com/carabiner-dev/deadrop -go 1.25.12 +go 1.26.0 require ( github.com/adrg/xdg v0.5.3 - github.com/carabiner-dev/command v0.3.1 - github.com/carabiner-dev/signer v0.6.1 + github.com/carabiner-dev/command v0.3.2 + github.com/carabiner-dev/signer v0.6.2 github.com/chainguard-dev/clog v1.8.1 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/sigstore/sigstore v1.10.9 @@ -26,11 +26,11 @@ require ( github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect - github.com/sirupsen/logrus v1.10.1 // indirect + github.com/sirupsen/logrus v1.10.2 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/crypto v0.54.0 // indirect + golang.org/x/crypto v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.47.0 // indirect gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect diff --git a/go.sum b/go.sum index abcda55..3d884ed 100644 --- a/go.sum +++ b/go.sum @@ -2,10 +2,10 @@ github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78= github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ= -github.com/carabiner-dev/command v0.3.1 h1:iBkh+AjwziFZmyihv/izypCV74nkmaslZxb5AgP7GP4= -github.com/carabiner-dev/command v0.3.1/go.mod h1:0mWfS5BU/krtaI1hgD5wjmLpjWVlf38KY8usA8zfF5c= -github.com/carabiner-dev/signer v0.6.1 h1:3GnpNt16Qzw476lgCGMZRThtofTy7Ke1A60HqNboWnc= -github.com/carabiner-dev/signer v0.6.1/go.mod h1:dg1OvK3lTePsPrbvoBZO5SBt0DHd2/NLdM2wfB2/4/8= +github.com/carabiner-dev/command v0.3.2 h1:lkmgr+Sj9OaPxKk2AHlitR76Mg+hqys6BK7071taywY= +github.com/carabiner-dev/command v0.3.2/go.mod h1:ABHTlUZbUUq7LF1Xmlx01ZY8xMCv4eqleuVEO/LIifU= +github.com/carabiner-dev/signer v0.6.2 h1:Tww40YP4RKjLSKdgT5nXVRiqd3Czjvkwd2WRDE7ecJ0= +github.com/carabiner-dev/signer v0.6.2/go.mod h1:xIeR0GMK3Hp9gYsd7dGO9W8EwjftWBk3/+flEle6o0Y= github.com/chainguard-dev/clog v1.8.1 h1:Lab3GEDsVm1J9XGlpWEBuzXX7eETRmd0vN5PYoNyT+Y= github.com/chainguard-dev/clog v1.8.1/go.mod h1:5MQOZi+Iu7fV7GcJG8ag8rCB5elEOpqRMKEASgnGVdo= github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA= @@ -42,8 +42,8 @@ github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGv github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q= github.com/sigstore/sigstore v1.10.9 h1:7Dcpt+ibnltHQZ8XhaU0dFmhHaf/T491eJfA9WDex4Y= github.com/sigstore/sigstore v1.10.9/go.mod h1:LYW9+qH7bK8wZmLm6lPxIC5lkHtkJDCgkqjChzTAIBs= -github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q= -github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk= +github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo= +github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= @@ -66,8 +66,8 @@ github.com/ysmood/leakless v0.9.0/go.mod h1:R8iAXPRaG97QJwqxs74RdwzcRHT1SWCGTNqY go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= From 638547e3d10ac4f93a1c7815d3d9b8966eacb6a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?= Date: Tue, 8 Sep 2026 16:11:46 -0600 Subject: [PATCH 2/2] Replace deprecated ecdsa.PublicKey MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Adolfo García Veytia (Puerco) --- pkg/cmd/verify.go | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/pkg/cmd/verify.go b/pkg/cmd/verify.go index f5c29f3..ced27e6 100644 --- a/pkg/cmd/verify.go +++ b/pkg/cmd/verify.go @@ -441,15 +441,21 @@ func jwkToECDSAPublicKey(jwk *JWK) (*ecdsa.PublicKey, error) { return nil, fmt.Errorf("failed to decode Y coordinate: %w", err) } - // Convert bytes to big integers - x := new(big.Int).SetBytes(xBytes) - y := new(big.Int).SetBytes(yBytes) - - // Create the ECDSA public key - publicKey := &ecdsa.PublicKey{ - Curve: curve, - X: x, - Y: y, + // Build the uncompressed point encoding (0x04 || X || Y), left-padding + // each coordinate to the curve's field size, and let the standard + // library validate that the point is on the curve. + fieldSize := (curve.Params().BitSize + 7) / 8 + if len(xBytes) > fieldSize || len(yBytes) > fieldSize { + return nil, fmt.Errorf("coordinate length exceeds field size for curve %s", jwk.Crv) + } + point := make([]byte, 1+2*fieldSize) + point[0] = 0x04 + copy(point[1+fieldSize-len(xBytes):], xBytes) + copy(point[1+2*fieldSize-len(yBytes):], yBytes) + + publicKey, err := ecdsa.ParseUncompressedPublicKey(curve, point) + if err != nil { + return nil, fmt.Errorf("failed to parse EC public key: %w", err) } return publicKey, nil