mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-11-02 18:44:25 -05:00
dependabot[bot]
3f7d649ca7
Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.19.1 to 1.21.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v1.19.1...v1.21.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.20.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
80 lines
3.9 KiB
Plaintext
80 lines
3.9 KiB
Plaintext
Changes
|
|
=======
|
|
|
|
v1.4.0 20 Aug 2026
|
|
* Add ML-DSA (FIPS 204) support: the `MLDSA44`, `MLDSA65`, and `MLDSA87`
|
|
algorithms, the `SignMLDSA()` / `VerifyMLDSA()` primitives, and a new
|
|
`MLDSAFamily` algorithm family. ML-DSA requires Go 1.27 or later, which is
|
|
when `crypto/mldsa` joins the standard library; on earlier toolchains the
|
|
constants are not declared and the algorithms are not registered.
|
|
|
|
An ML-DSA key carries its own parameter set, so naming an algorithm that
|
|
disagrees with the key is an error on both the sign and verify paths.
|
|
`SignMLDSA()` takes a `crypto.SignerOpts` so that both signing modes stay
|
|
reachable: an `*mldsa.Options` supplies a context string, and
|
|
`crypto.MLDSAMu` signs a pre-hashed mu message representative.
|
|
`VerifyMLDSA()` takes an `*mldsa.Options` because verification has a single
|
|
mode. `SignDigest()` and `VerifyDigest()` return an error for ML-DSA, as
|
|
they already do for EdDSA.
|
|
|
|
* The minimum Go version is now 1.25.
|
|
|
|
v1.3.0 13 Apr 2026
|
|
* Add `SignWithOpts()` and `VerifyWithOpts()`, which thread an optional
|
|
`crypto.SignerOpts` through to the underlying signer. For built-in
|
|
families (HMAC, RSA, ECDSA, EdDSA) the opts argument is ignored. For
|
|
the `Custom` family, opts are forwarded to the algorithm's Meta when
|
|
it implements the new `SignerWithOpts` / `VerifierWithOpts` interfaces;
|
|
otherwise the dispatcher falls back to the plain `Signer` / `Verifier`
|
|
methods and the opts are dropped. The canonical use case is composite
|
|
ML-DSA signatures, where a per-call domain-separation context
|
|
(`*mldsa.Options`) must reach `filippo.io/mldsa`.
|
|
|
|
* `Sign()` is now a one-line wrapper around `SignWithOpts()` (and
|
|
`Verify()` likewise wraps `VerifyWithOpts()`). The public signatures
|
|
of `Sign` and `Verify` are unchanged; the only observable difference
|
|
for existing callers is one extra call frame.
|
|
|
|
* `RegisterAlgorithm()` for the `Custom` family now accepts a Meta that
|
|
implements only `SignerWithOpts` / `VerifierWithOpts` (in addition to
|
|
the existing `Signer` / `Verifier` paths).
|
|
|
|
* In dsig v2, `Sign` / `Verify` will absorb the opts parameter and
|
|
`SignWithOpts` / `VerifyWithOpts` will be removed. The same migration
|
|
is planned for `SignDigest` / `VerifyDigest` once a `DigestSigner`
|
|
interface for the `Custom` family lands. Doc comments on all four
|
|
entry points flag the upcoming change.
|
|
|
|
v1.2.2 13 Apr 2026
|
|
* Add `SignECDSADER()` and `VerifyECDSADER()` primitive helpers for ECDSA
|
|
signatures in ASN.1 DER-encoded `Ecdsa-Sig-Value` form (RFC 3279 §2.2.3),
|
|
as used by X.509/PKIX and composite signature schemes. The existing
|
|
`SignECDSA()`/`VerifyECDSA()` functions remain the canonical entry points
|
|
for the JWS-native fixed-length r||s format (RFC 7515 §3.4).
|
|
|
|
v1.2.1 7 Apr 2026
|
|
* Add `SignDigest()` for signing pre-computed digests. Supported for HMAC,
|
|
RSA (PKCS1v15 and PSS), and ECDSA families. EdDSA and Custom return an error.
|
|
|
|
v1.2.0 6 Apr 2026
|
|
* Add `VerifyDigest()` for verifying signatures against pre-computed digests.
|
|
Supported for HMAC, RSA, and ECDSA families. EdDSA and Custom return an error.
|
|
|
|
* Add low-level digest verification functions: `VerifyHMACDigest()`,
|
|
`VerifyRSADigest()`, `VerifyECDSADigest()`.
|
|
|
|
v1.1.0 2 Apr 2026
|
|
* Add `Custom` algorithm family for registering user-defined sign/verify
|
|
implementations. For the `Custom` family, `AlgorithmInfo.Meta` must implement
|
|
the `Signer` and/or `Verifier` interfaces. The implementation struct can
|
|
carry any additional metadata it needs (hash functions, curves, etc.).
|
|
|
|
* Add `UnregisterAlgorithm()` for removing previously registered custom
|
|
algorithms. Built-in algorithms are protected and cannot be unregistered.
|
|
|
|
* `RegisterAlgorithm()` now rejects re-registration of an already-registered
|
|
algorithm name. Use `UnregisterAlgorithm()` first if you need to replace it.
|
|
|
|
v1.0.0 - 18 Aug 2025
|
|
* Initial release
|