* build(deps): bump github.com/quic-go/quic-go from 0.40.1 to 0.42.0
Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.40.1 to 0.42.0.
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Changelog](https://github.com/quic-go/quic-go/blob/master/Changelog.md)
- [Commits](https://github.com/quic-go/quic-go/compare/v0.40.1...v0.42.0)
---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* update: remove dependency of quic-go
We now vendor the quicvarint submodule from quic-go for a minimal dependency tree.
This also updates the minimal Go version requirement to Go 1.21, given uTLS promised to support 2 most recent minor versions of Go.
Signed-off-by: Gaukas Wang <i@gaukas.wang>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Gaukas Wang <i@gaukas.wang>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gaukas Wang <i@gaukas.wang>
* ci: use latest Go 1.21 build
Use `1.21.x` instead of `1.21.0` to automatically select the latest.
* fix: remove unused fipsonly package
Remove an unused package that was unintendedly introduced as a conditional dependency of upstream
* update: use boring package not global var
Align with the upstream to use `boring` as a name for a package. No functional changes.
* new: name aliasing
Create u_alias.go to hold any alias names created by version upgrades or other necessary changes (e.g., upstream breaking change) to prevent further breaking the API.
* sync: Go 1.21.0
* [release-branch.go1.21] crypto/tls: change SendSessionTicket to take an options struct
To allow for future evolution of the API, make
QUICConn.SendSessionTicket take a QUICSessionTicketOptions
rather than a single bool.
Change-Id: I798fd0feec5c7581e3c3574e2de99611c81df47f
Reviewed-on: https://go-review.googlesource.com/c/go/+/514997
Reviewed-by: Roland Shoemaker <roland@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Marten Seemann <martenseemann@gmail.com>
(cherry picked from commit a915b99)
Reviewed-on: https://go-review.googlesource.com/c/go/+/515335
Auto-Submit: Damien Neil <dneil@google.com>
Co-Authored-By: Damien Neil <52544+neild@users.noreply.github.com>
* new: CI bump up to use Go 1.21.0 stable release
* fix: better CI streamline for multi-platform
---------
Co-authored-by: Damien Neil <52544+neild@users.noreply.github.com>
* sync: Go 1.21rc3, QUIC support added (#207)
* sync: merge with upstream tag/go-1.21rc3 (#11)
* fix: all tests pass
* impl: UQUIC Transport
* deps: bump up min Go version
* new: uquic
* fix: add QUICTransportParameter
* deprecated: Go 1.19 no longer supported
Go 1.19 will fail to build or pass the test once we bump up to the new version.
* sync: crypto/tls: restrict RSA keys in certificates to <= 8192 bits (#209)
* [release-branch.go1.21] crypto/tls: restrict RSA keys in certificates to <= 8192 bits
Extremely large RSA keys in certificate chains can cause a client/server
to expend significant CPU time verifying signatures. Limit this by
restricting the size of RSA keys transmitted during handshakes to <=
8192 bits.
Based on a survey of publicly trusted RSA keys, there are currently only
three certificates in circulation with keys larger than this, and all
three appear to be test certificates that are not actively deployed. It
is possible there are larger keys in use in private PKIs, but we target
the web PKI, so causing breakage here in the interests of increasing the
default safety of users of crypto/tls seems reasonable.
Thanks to Mateusz Poliwczak for reporting this issue.
Fixes CVE-2023-29409
* build: [ci skip] boring not included
* fix: typo [ci skip]
* docs: replenish readme [ci skip]
replace old build status badge with new ones, bump up required version noted in docs, update developer contact to reflect current status.
