From c10403053a57d83119264f4a67c91ee48e61b9ee Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Sep 2025 16:17:21 +0000 Subject: [PATCH 1/4] Bump golang.org/x/crypto from 0.41.0 to 0.42.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.41.0 to 0.42.0. - [Commits](https://github.com/golang/crypto/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 14 +++++++------- go.sum | 24 ++++++++++++------------ 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/go.mod b/go.mod index 60afe0e1..aab0a1fd 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/smallstep/cli -go 1.23.7 +go 1.24.0 require ( github.com/Microsoft/go-winio v0.6.2 @@ -28,9 +28,9 @@ require ( github.com/urfave/cli v1.22.17 go.mozilla.org/pkcs7 v0.9.0 go.step.sm/crypto v0.70.0 - golang.org/x/crypto v0.41.0 - golang.org/x/sys v0.35.0 - golang.org/x/term v0.34.0 + golang.org/x/crypto v0.42.0 + golang.org/x/sys v0.36.0 + golang.org/x/term v0.35.0 google.golang.org/protobuf v1.36.8 software.sslmate.com/src/go-pkcs12 v0.6.0 ) @@ -129,10 +129,10 @@ require ( golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect golang.org/x/net v0.43.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect - golang.org/x/sync v0.16.0 // indirect - golang.org/x/text v0.28.0 // indirect + golang.org/x/sync v0.17.0 // indirect + golang.org/x/text v0.29.0 // indirect golang.org/x/time v0.12.0 // indirect - golang.org/x/tools v0.35.0 // indirect + golang.org/x/tools v0.36.0 // indirect google.golang.org/api v0.247.0 // indirect google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect diff --git a/go.sum b/go.sum index 6a7a3de9..3bd9329c 100644 --- a/go.sum +++ b/go.sum @@ -371,8 +371,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= -golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4= -golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc= +golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI= +golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8= golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o= golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= @@ -401,8 +401,8 @@ golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= -golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= +golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -423,8 +423,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= -golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= +golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -435,8 +435,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8= golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= -golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4= -golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= +golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ= +golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= @@ -447,8 +447,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= -golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= -golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= +golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk= +golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -457,8 +457,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0= -golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw= +golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg= +golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/api v0.247.0 h1:tSd/e0QrUlLsrwMKmkbQhYVa109qIintOls2Wh6bngc= google.golang.org/api v0.247.0/go.mod h1:r1qZOPmxXffXg6xS5uhx16Fa/UFY8QU/K4bfKrnvovM= From ce156654f4c5d5c4276dbff3c187347bec2ad610 Mon Sep 17 00:00:00 2001 From: Herman Slatman Date: Tue, 9 Sep 2025 10:13:22 +0200 Subject: [PATCH 2/4] Make a bad RSA key by overriding the modulus In more recent Go versions requirements for RSA keys have been strengthened, resulting in errors when trying to generate insecure keys. In this specific test case we need a bad RSA key. --- token/token_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/token/token_test.go b/token/token_test.go index f7fe09cf..74e05bb5 100644 --- a/token/token_test.go +++ b/token/token_test.go @@ -4,6 +4,7 @@ import ( "crypto/ed25519" "crypto/rand" "crypto/rsa" + "math/big" "reflect" "testing" "time" @@ -95,10 +96,11 @@ func TestClaims_Sign(t *testing.T) { t.Fatal(err) } - badKey, err := rsa.GenerateKey(rand.Reader, 123) + badKey, err := rsa.GenerateKey(rand.Reader, 1024) if err != nil { t.Fatal(err) } + badKey.N = big.NewInt(10) // render key useless for signing tests := []struct { name string From c186eb764ea0db9fb94a681d995f5047242617d1 Mon Sep 17 00:00:00 2001 From: Herman Slatman Date: Tue, 9 Sep 2025 10:15:12 +0200 Subject: [PATCH 3/4] Update expected error message for insecure RSA key generation --- integration/testdata/crypto/keypair.txtar | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration/testdata/crypto/keypair.txtar b/integration/testdata/crypto/keypair.txtar index d1b70e26..6d7bf938 100644 --- a/integration/testdata/crypto/keypair.txtar +++ b/integration/testdata/crypto/keypair.txtar @@ -69,7 +69,7 @@ stderr 'flag ''--size'' must be greater than or equal to 0' # RSA size 16 with insecure flag; skipped on Go < 1.24, because small keys were supported on those [go1.24] ! exec step crypto keypair --password-file password.txt --kty RSA --size 16 --insecure rsa-error.pub rsa-error.priv -[go1.24] stderr 'error generating RSA key: rsa: key too small' +[go1.24] stderr 'error generating RSA key: crypto/rsa: 16-bit keys are insecure' # RSA size 1024 without insecure flag From 7e79592e787e677b45f18606f60c41566831db88 Mon Sep 17 00:00:00 2001 From: Herman Slatman Date: Wed, 10 Sep 2025 10:59:11 +0200 Subject: [PATCH 4/4] Remove `testscript` conditionals for Go versions < 1.24 Since we're now supporting Go 1.24+, there's no need to maintain the exclusion of some test cases using `[go1.24]`, so those were removed. --- integration/testdata/crypto/jwk-create-rsa.txtar | 6 +++--- integration/testdata/crypto/keypair.txtar | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/integration/testdata/crypto/jwk-create-rsa.txtar b/integration/testdata/crypto/jwk-create-rsa.txtar index 0fc66e86..ad2e0f17 100644 --- a/integration/testdata/crypto/jwk-create-rsa.txtar +++ b/integration/testdata/crypto/jwk-create-rsa.txtar @@ -53,9 +53,9 @@ check_jwk rsa-2048-ps512.pub rsa-2048-ps512.priv RSA 2048 PS512 stderr 'flag ''--size'' requires at least 2048 unless ''--insecure'' flag is provided' -# RSA 1024, PS256 with insecure flag; skipped on Go < 1.24, because small keys were supported on those -[go1.24] ! exec step crypto jwk create --password-file password.txt --kty RSA --size 1024 --alg PS256 rsa-1024-ps256.pub rsa-1024-ps256.priv --insecure -[go1.24] stderr 'the size of the RSA key should be at least 2048 bits' +# RSA 1024, PS256 with insecure flag +! exec step crypto jwk create --password-file password.txt --kty RSA --size 1024 --alg PS256 rsa-1024-ps256.pub rsa-1024-ps256.priv --insecure +stderr 'the size of the RSA key should be at least 2048 bits' # RSA 0, PS256 diff --git a/integration/testdata/crypto/keypair.txtar b/integration/testdata/crypto/keypair.txtar index 6d7bf938..fcaf65f6 100644 --- a/integration/testdata/crypto/keypair.txtar +++ b/integration/testdata/crypto/keypair.txtar @@ -67,9 +67,9 @@ stderr 'flag ''--size'' requires at least 2048 unless ''--insecure'' flag is pro stderr 'flag ''--size'' must be greater than or equal to 0' -# RSA size 16 with insecure flag; skipped on Go < 1.24, because small keys were supported on those -[go1.24] ! exec step crypto keypair --password-file password.txt --kty RSA --size 16 --insecure rsa-error.pub rsa-error.priv -[go1.24] stderr 'error generating RSA key: crypto/rsa: 16-bit keys are insecure' +# RSA size 16 with insecure flag +! exec step crypto keypair --password-file password.txt --kty RSA --size 16 --insecure rsa-error.pub rsa-error.priv +stderr 'error generating RSA key: crypto/rsa: 16-bit keys are insecure' # RSA size 1024 without insecure flag