go-x-crypto, branch v0.42.0

go.mod: update golang.org/x dependencies

2025-09-08T15:14:28Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I75e16a930bfe42cc082df82ab67802c42ad56a97 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/701303 LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: Michael Pratt Auto-Submit: Gopher Robot

acme: include order problem in OrderError

2025-09-04T14:39:59Z

If client.WaitOrder or client.CreateOrderCert return an acme.OrderError it's helpful to include the order's problem field (if available). This will often have detailed information about why a particular order became invalid that's invaluable for debugging (e.g. a challenge response was incorrect, a name couldn't be resolved, etc). While it's possible for a consumer to poll the order themselves as part of handling the order to extract a fresh Order.Error field value, it would take an extra round-trip network request. Since we have the underlying error in-hand when we produce the OrderError we might as well include it directly. Since this field is a structured object with a number of sub-fields the OrderError.Error() function isn't updated to include the order problem error in the String description. Interested callers should instead use errors.Is to extract the problem information directly. Resolves golang/go#74430 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest Change-Id: I3158f064793bbfdc292dd6b5e1a6bfd7729bd980 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/681037 Auto-Submit: Daniel McCarney Reviewed-by: Roland Shoemaker Reviewed-by: Michael Pratt Reviewed-by: Ian Stapleton Cordasco LUCI-TryBot-Result: Go LUCI

ssh: remove Go 1.24 build tag for ML-KEM kex

2025-08-26T07:42:33Z

Change-Id: Ia77ad1b6fef9919ab100fb10c42231725eb81c12 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/698775 LUCI-TryBot-Result: Go LUCI Auto-Submit: Nicola Murino Reviewed-by: Filippo Valsorda Reviewed-by: Cherry Mui Reviewed-by: Roland Shoemaker

ssh/knownhosts: improve IPv6 support in Normalize

2025-08-19T20:12:03Z

Correctly converts bracketed IPv6: - [abcd::abcd:abcd:abcd] => abcd::abcd:abcd:abcd - [abcd::abcd:abcd:abcd]:22 => abcd::abcd:abcd:abcd - [abcd::abcd:abcd:abcd]:23 => [abcd::abcd:abcd:abcd]:23 Fixes golang/go#53463 Change-Id: Id0a7460d8448a72e2a8c6d46137245bead9ecf9f Reviewed-on: https://go-review.googlesource.com/c/crypto/+/694575 LUCI-TryBot-Result: Go LUCI Reviewed-by: Filippo Valsorda Reviewed-by: David Chase Reviewed-by: Carlos Amedee

curve25519: include potential fips140=only error in panic message

2025-08-19T17:40:36Z

Updates golang/go#75061 Change-Id: I6a6a696474122a12c12696d8a2efec902572327d Reviewed-on: https://go-review.googlesource.com/c/crypto/+/696996 Reviewed-by: Nicola Murino Auto-Submit: Filippo Valsorda Reviewed-by: David Chase LUCI-TryBot-Result: Go LUCI Reviewed-by: Carlos Amedee

ssh: use curve25519.X25519 instead of curve25519.ScalarMult

2025-08-19T17:38:43Z

This lets us surface an error message instead of panicking if running in fips140=only mode, where ECDH on X25519 returns an error. Updates golang/go#75061 Change-Id: I6a6a6964c0591f3dca2dc946c99d44364314a3ab Reviewed-on: https://go-review.googlesource.com/c/crypto/+/696995 Reviewed-by: Carlos Amedee Reviewed-by: David Chase LUCI-TryBot-Result: Go LUCI Auto-Submit: Filippo Valsorda Reviewed-by: Nicola Murino

all: upgrade go directive to at least 1.24.0 [generated]

2025-08-13T15:00:22Z

By now Go 1.25.0 has been released, and Go 1.23 is no longer supported per the Go Release Policy (see https://go.dev/doc/devel/release#policy). For golang/go#69095. [git-generate] (cd . && go get go@1.24.0 && go mod tidy && go fix ./... && go mod edit -toolchain=none) (cd x509roots/fallback && go get go@1.24.0 && go mod tidy && go fix ./... && go mod edit -toolchain=none) Change-Id: Ia4c201e9611a2c13489e16d4ae81d7e3e32bf455 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/695715 Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: David Chase

go.mod: update golang.org/x dependencies

2025-08-07T17:21:04Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I93de641462a54b0ae565bb60e2a0e6e7c2c3b883 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/693999 LUCI-TryBot-Result: Go LUCI Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: David Chase

acme: fix pebble subprocess output data race

2025-08-06T20:33:03Z

Wait for process completion before reading stdout/stderr buffers to eliminate race between I/O Go routines and test cleanup. Updates golang/go#74437 Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-linux-amd64-longtest-race Change-Id: I2e650c04db5be0d7a1e858ce40e25f13ad12223c Reviewed-on: https://go-review.googlesource.com/c/crypto/+/693596 Auto-Submit: Daniel McCarney Reviewed-by: Roland Shoemaker Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI

x509roots/fallback: store bundle certs directly in DER

2025-08-03T19:47:17Z

goos: linux goarch: amd64 pkg: golang.org/x/crypto/x509roots/fallback cpu: AMD Ryzen 5 4600G with Radeon Graphics │ /tmp/before │ /tmp/after │ │ sec/op │ sec/op vs base │ InitTime-12 1.726m ± 0% 1.101m ± 1% -36.20% (p=0.000 n=30) │ /tmp/before │ /tmp/after │ │ B/op │ B/op vs base │ InitTime-12 1178.2Ki ± 0% 779.8Ki ± 0% -33.81% (p=0.000 n=30) │ /tmp/before │ /tmp/after │ │ allocs/op │ allocs/op vs base │ InitTime-12 11.35k ± 0% 10.64k ± 0% -6.32% (p=0.000 n=30) Updates golang/go#73691 Change-Id: Ic33f2fdfc65001c41afeb3b6af8a383288d10de6 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/676217 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Mark Freeman