Skip to content

security: prove openpgp is not shipped - #4

Merged
chen21019 merged 1 commit into
mainfrom
security/openpgp-vex-20260826
Aug 26, 2026
Merged

security: prove openpgp is not shipped#4
chen21019 merged 1 commit into
mainfrom
security/openpgp-vex-20260826

Conversation

@chen21019

Copy link
Copy Markdown

Result

  • bind the GO-2026-5932 OpenVEX decision to x/crypto v0.55.0
  • fail validation if openpgp becomes reachable or appears in vendor
  • document the SSH-only x/crypto package boundary

Verification

  • GOOS=linux GOARCH=amd64 ./scripts/validate passed
  • current dependency graph has zero openpgp packages

@chen21019
chen21019 requested a review from a team as a code owner August 26, 2026 07:37
@chen21019
chen21019 merged commit b7f20e1 into main Aug 26, 2026
6 checks passed
@chen21019
chen21019 deleted the security/openpgp-vex-20260826 branch August 26, 2026 07:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant