go-x-crypto, branch v0.43.0

go.mod: update golang.org/x dependencies

2025-10-08T17:40:45Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: Icf986acf9290649488777328f470200bf9e11442 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/710098 Reviewed-by: David Chase LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov

acme: fix autocert TestHTTPHandlerDefaultFallback

2025-10-08T16:52:31Z

The Go 1.25.2 release made net/url stricter about parsing bracketed IPv6 hostnames, and is rejecting some test URLs used in the autocert TestHTTPHandlerDefaultFallback test with an error about the colon-separated fields requiring at least one hex digit. This commit replaces the invalid `xxxx` portion of some test URLS with valid hex digits, fixing the test regression. Change-Id: I84c192b1cd6daf53ef4199f7987437fd825f7041 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/710155 Reviewed-by: Roland Shoemaker Auto-Submit: Daniel McCarney Reviewed-by: Filippo Valsorda Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI

x509roots/fallback: update bundle

2025-10-08T15:14:13Z

This is an automated CL which updates the NSS root bundle. [git-generate] go generate ./x509roots Change-Id: I9ab454c977013b2f6a42bc93fb0649612c54c6c0 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/709475 Reviewed-by: Roland Shoemaker Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov

ssh: add VerifiedPublicKeyCallback

2025-09-27T19:43:41Z

Fixes golang/go#70795 Change-Id: I9b7c91f35f89495d1e9b5f6ec0c036c02a61d774 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/636335 Reviewed-by: Michael Knyszek Reviewed-by: Junyang Shao Reviewed-by: Ilia Mirkin Reviewed-by: Filippo Valsorda LUCI-TryBot-Result: Go LUCI Reviewed-by: Jorge Hernández

ssh: add support for FIPS mode

2025-09-27T19:36:52Z

Unsupported algoritms are silently ignored and not negotiated, or rejected Fixes golang/go#75061 Change-Id: I08d50d10a97c08e78aedead89ca61beceff88918 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/698795 Reviewed-by: Mio Mio Reviewed-by: Junyang Shao Reviewed-by: Filippo Valsorda Reviewed-by: Michael Knyszek LUCI-TryBot-Result: Go LUCI

ssh: remove custom contains, use slices.Contains

2025-09-16T06:33:16Z

Change-Id: If4784469e7285675bdd51399a76bdc16f0036a2e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/703635 Reviewed-by: Mark Freeman Reviewed-by: Sean Liao Reviewed-by: Michael Knyszek LUCI-TryBot-Result: Go LUCI

ssh: return clearer error when signature algorithm is used as key format

2025-09-16T06:32:56Z

ParsePublicKey now returns a more specific error when a signature algorithm like rsa-sha2-256 is mistakenly provided as a key format Change-Id: Ic08286a5b2b326e99dd3e61594919203f0c36791 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/695075 Reviewed-by: Filippo Valsorda LUCI-TryBot-Result: Go LUCI Reviewed-by: Mark Freeman Reviewed-by: Michael Knyszek

x509roots/fallback/bundle: add bundle package to export root certs

2025-09-11T15:14:50Z

Fixes golang/go#69898 Change-Id: Idbb1bbe48016a622414c84a56fe26f48bfe712c8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/687155 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Auto-Submit: Roland Shoemaker Reviewed-by: Mateusz Poliwczak

all: freeze and deprecate more packages

2025-09-09T19:19:31Z

Fixes golang/go#65250 Change-Id: I6a6a6964a2c87e529be50dd67fec462483b07b75 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/701535 Reviewed-by: Mark Freeman Auto-Submit: Filippo Valsorda Reviewed-by: Daniel McCarney LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt

ssh/agent: return an error for unexpected message types

2025-09-09T09:56:19Z

Previously, receiving an unexpected message type in response to a key listing or a signing request could cause a panic due to a failed type assertion. This change adds a default case to the type switch in order to detect and explicitly handle unknown or invalid message types, returning a descriptive error instead of crashing. Fixes golang/go#75178 Change-Id: Icbc3432adc79fe3c56b1ff23c6724d7a6f710f3a Reviewed-on: https://go-review.googlesource.com/c/crypto/+/700295 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt Reviewed-by: Jakub Ciolek