Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.go

@@ -11,12 +11,15 @@ import (
 	goerrors "errors"
 	"io"
 	"math/big"
+	"time"
 
 	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
 	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
-	"golang.org/x/crypto/ed25519"
 )
 
 // NewEntity returns an Entity that contains a fresh RSA/RSA keypair with a
@@ -27,11 +30,6 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
 	creationTime := config.Now()
 	keyLifetimeSecs := config.KeyLifetime()
 
-	uid := packet.NewUserId(name, comment, email)
-	if uid == nil {
-		return nil, errors.InvalidArgumentError("user id field contained invalid characters")
-	}
-
 	// Generate a primary signing key
 	primaryPrivRaw, err := newSigner(config)
 	if err != nil {
@@ -42,28 +40,66 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
 		primary.UpgradeToV5()
 	}
 
-	isPrimaryId := true
-	selfSignature := &packet.Signature{
-		Version:           primary.PublicKey.Version,
-		SigType:           packet.SigTypePositiveCert,
-		PubKeyAlgo:        primary.PublicKey.PubKeyAlgo,
-		Hash:              config.Hash(),
-		CreationTime:      creationTime,
-		KeyLifetimeSecs:   &keyLifetimeSecs,
-		IssuerKeyId:       &primary.PublicKey.KeyId,
-		IssuerFingerprint: primary.PublicKey.Fingerprint,
-		IsPrimaryId:       &isPrimaryId,
-		FlagsValid:        true,
-		FlagSign:          true,
-		FlagCertify:       true,
-		MDC:               true, // true by default, see 5.8 vs. 5.14
-		AEAD:              config.AEAD() != nil,
-		V5Keys:            config != nil && config.V5Keys,
+	e := &Entity{
+		PrimaryKey: &primary.PublicKey,
+		PrivateKey: primary,
+		Identities: make(map[string]*Identity),
+		Subkeys:    []Subkey{},
 	}
 
+	err = e.addUserId(name, comment, email, config, creationTime, keyLifetimeSecs)
+	if err != nil {
+		return nil, err
+	}
+
+	// NOTE: No key expiry here, but we will not return this subkey in EncryptionKey()
+	// if the primary/master key has expired.
+	err = e.addEncryptionSubkey(config, creationTime, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	return e, nil
+}
+
+func (t *Entity) AddUserId(name, comment, email string, config *packet.Config) error {
+	creationTime := config.Now()
+	keyLifetimeSecs := config.KeyLifetime()
+	return t.addUserId(name, comment, email, config, creationTime, keyLifetimeSecs)
+}
+
+func (t *Entity) addUserId(name, comment, email string, config *packet.Config, creationTime time.Time, keyLifetimeSecs uint32) error {
+	uid := packet.NewUserId(name, comment, email)
+	if uid == nil {
+		return errors.InvalidArgumentError("user id field contained invalid characters")
+	}
+
+	if _, ok := t.Identities[uid.Id]; ok {
+		return errors.InvalidArgumentError("user id exist")
+	}
+
+	primary := t.PrivateKey
+
+	isPrimaryId := len(t.Identities) == 0
+
+	selfSignature := createSignaturePacket(&primary.PublicKey, packet.SigTypePositiveCert, config)
+	selfSignature.CreationTime = creationTime
+	selfSignature.KeyLifetimeSecs = &keyLifetimeSecs
+	selfSignature.IsPrimaryId = &isPrimaryId
+	selfSignature.FlagsValid = true
+	selfSignature.FlagSign = true
+	selfSignature.FlagCertify = true
+	selfSignature.SEIPDv1 = true // true by default, see 5.8 vs. 5.14
+	selfSignature.SEIPDv2 = config.AEAD() != nil
+
 	// Set the PreferredHash for the SelfSignature from the packet.Config.
 	// If it is not the must-implement algorithm from rfc4880bis, append that.
-	selfSignature.PreferredHash = []uint8{hashToHashId(config.Hash())}
+	hash, ok := algorithm.HashToHashId(config.Hash())
+	if !ok {
+		return errors.UnsupportedError("unsupported preferred hash function")
+	}
+
+	selfSignature.PreferredHash = []uint8{hash}
 	if config.Hash() != crypto.SHA256 {
 		selfSignature.PreferredHash = append(selfSignature.PreferredHash, hashToHashId(crypto.SHA256))
 	}
@@ -84,66 +120,30 @@ func NewEntity(name, comment, email string, config *packet.Config) (*Entity, err
 	}
 
 	// And for DefaultMode.
-	selfSignature.PreferredAEAD = []uint8{uint8(config.AEAD().Mode())}
-	if config.AEAD().Mode() != packet.AEADModeEAX {
-		selfSignature.PreferredAEAD = append(selfSignature.PreferredAEAD, uint8(packet.AEADModeEAX))
+	modes := []uint8{uint8(config.AEAD().Mode())}
+	if config.AEAD().Mode() != packet.AEADModeOCB {
+		modes = append(modes, uint8(packet.AEADModeOCB))
+	}
+
+	// For preferred (AES256, GCM), we'll generate (AES256, GCM), (AES256, OCB), (AES128, GCM), (AES128, OCB)
+	for _, cipher := range selfSignature.PreferredSymmetric {
+		for _, mode := range modes {
+			selfSignature.PreferredCipherSuites = append(selfSignature.PreferredCipherSuites, [2]uint8{cipher, mode})
+		}
 	}
 
 	// User ID binding signature
-	err = selfSignature.SignUserId(uid.Id, &primary.PublicKey, primary, config)
+	err := selfSignature.SignUserId(uid.Id, &primary.PublicKey, primary, config)
 	if err != nil {
-		return nil, err
+		return err
 	}
-
-	// Generate an encryption subkey
-	subPrivRaw, err := newDecrypter(config)
-	if err != nil {
-		return nil, err
+	t.Identities[uid.Id] = &Identity{
+		Name:          uid.Id,
+		UserId:        uid,
+		SelfSignature: selfSignature,
+		Signatures:    []*packet.Signature{selfSignature},
 	}
-	sub := packet.NewDecrypterPrivateKey(creationTime, subPrivRaw)
-	sub.IsSubkey = true
-	sub.PublicKey.IsSubkey = true
-	if config != nil && config.V5Keys {
-		sub.UpgradeToV5()
-	}
-
-	// NOTE: No KeyLifetimeSecs here, but we will not return this subkey in EncryptionKey()
-	// if the primary/master key has expired.
-	subKey := Subkey{
-		PublicKey:  &sub.PublicKey,
-		PrivateKey: sub,
-		Sig: &packet.Signature{
-			Version:                   primary.PublicKey.Version,
-			CreationTime:              creationTime,
-			SigType:                   packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:                primary.PublicKey.PubKeyAlgo,
-			Hash:                      config.Hash(),
-			FlagsValid:                true,
-			FlagEncryptStorage:        true,
-			FlagEncryptCommunications: true,
-			IssuerKeyId:               &primary.PublicKey.KeyId,
-		},
-	}
-
-	// Subkey binding signature
-	err = subKey.Sig.SignKey(subKey.PublicKey, primary, config)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Entity{
-		PrimaryKey: &primary.PublicKey,
-		PrivateKey: primary,
-		Identities: map[string]*Identity{
-			uid.Id: &Identity{
-				Name:          uid.Id,
-				UserId:        uid,
-				SelfSignature: selfSignature,
-				Signatures:    []*packet.Signature{selfSignature},
-			},
-		},
-		Subkeys: []Subkey{subKey},
-	}, nil
+	return nil
 }
 
 // AddSigningSubkey adds a signing keypair as a subkey to the Entity.
@@ -157,42 +157,30 @@ func (e *Entity) AddSigningSubkey(config *packet.Config) error {
 		return err
 	}
 	sub := packet.NewSignerPrivateKey(creationTime, subPrivRaw)
+	sub.IsSubkey = true
+	if config != nil && config.V5Keys {
+		sub.UpgradeToV5()
+	}
 
 	subkey := Subkey{
 		PublicKey:  &sub.PublicKey,
 		PrivateKey: sub,
-		Sig: &packet.Signature{
-			Version:         e.PrimaryKey.Version,
-			CreationTime:    creationTime,
-			KeyLifetimeSecs: &keyLifetimeSecs,
-			SigType:         packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:      e.PrimaryKey.PubKeyAlgo,
-			Hash:            config.Hash(),
-			FlagsValid:      true,
-			FlagSign:        true,
-			IssuerKeyId:     &e.PrimaryKey.KeyId,
-			EmbeddedSignature: &packet.Signature{
-				Version:      e.PrimaryKey.Version,
-				CreationTime: creationTime,
-				SigType:      packet.SigTypePrimaryKeyBinding,
-				PubKeyAlgo:   sub.PublicKey.PubKeyAlgo,
-				Hash:         config.Hash(),
-				IssuerKeyId:  &e.PrimaryKey.KeyId,
-			},
-		},
-	}
-	if config != nil && config.V5Keys {
-		subkey.PublicKey.UpgradeToV5()
 	}
+	subkey.Sig = createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyBinding, config)
+	subkey.Sig.CreationTime = creationTime
+	subkey.Sig.KeyLifetimeSecs = &keyLifetimeSecs
+	subkey.Sig.FlagsValid = true
+	subkey.Sig.FlagSign = true
+	subkey.Sig.EmbeddedSignature = createSignaturePacket(subkey.PublicKey, packet.SigTypePrimaryKeyBinding, config)
+	subkey.Sig.EmbeddedSignature.CreationTime = creationTime
 
 	err = subkey.Sig.EmbeddedSignature.CrossSignKey(subkey.PublicKey, e.PrimaryKey, subkey.PrivateKey, config)
 	if err != nil {
 		return err
 	}
 
-	subkey.PublicKey.IsSubkey = true
-	subkey.PrivateKey.IsSubkey = true
-	if err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config); err != nil {
+	err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+	if err != nil {
 		return err
 	}
 
@@ -205,36 +193,33 @@ func (e *Entity) AddSigningSubkey(config *packet.Config) error {
 func (e *Entity) AddEncryptionSubkey(config *packet.Config) error {
 	creationTime := config.Now()
 	keyLifetimeSecs := config.KeyLifetime()
+	return e.addEncryptionSubkey(config, creationTime, keyLifetimeSecs)
+}
 
+func (e *Entity) addEncryptionSubkey(config *packet.Config, creationTime time.Time, keyLifetimeSecs uint32) error {
 	subPrivRaw, err := newDecrypter(config)
 	if err != nil {
 		return err
 	}
 	sub := packet.NewDecrypterPrivateKey(creationTime, subPrivRaw)
+	sub.IsSubkey = true
+	if config != nil && config.V5Keys {
+		sub.UpgradeToV5()
+	}
 
 	subkey := Subkey{
 		PublicKey:  &sub.PublicKey,
 		PrivateKey: sub,
-		Sig: &packet.Signature{
-			Version:                   e.PrimaryKey.Version,
-			CreationTime:              creationTime,
-			KeyLifetimeSecs:           &keyLifetimeSecs,
-			SigType:                   packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:                e.PrimaryKey.PubKeyAlgo,
-			Hash:                      config.Hash(),
-			FlagsValid:                true,
-			FlagEncryptStorage:        true,
-			FlagEncryptCommunications: true,
-			IssuerKeyId:               &e.PrimaryKey.KeyId,
-		},
-	}
-	if config != nil && config.V5Keys {
-		subkey.PublicKey.UpgradeToV5()
 	}
+	subkey.Sig = createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyBinding, config)
+	subkey.Sig.CreationTime = creationTime
+	subkey.Sig.KeyLifetimeSecs = &keyLifetimeSecs
+	subkey.Sig.FlagsValid = true
+	subkey.Sig.FlagEncryptStorage = true
+	subkey.Sig.FlagEncryptCommunications = true
 
-	subkey.PublicKey.IsSubkey = true
-	subkey.PrivateKey.IsSubkey = true
-	if err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config); err != nil {
+	err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+	if err != nil {
 		return err
 	}
 
@@ -243,7 +228,7 @@ func (e *Entity) AddEncryptionSubkey(config *packet.Config) error {
 }
 
 // Generates a signing key
-func newSigner(config *packet.Config) (signer crypto.Signer, err error) {
+func newSigner(config *packet.Config) (signer interface{}, err error) {
 	switch config.PublicKeyAlgorithm() {
 	case packet.PubKeyAlgoRSA:
 		bits := config.RSAModulusBits()
@@ -257,11 +242,27 @@ func newSigner(config *packet.Config) (signer crypto.Signer, err error) {
 		}
 		return rsa.GenerateKey(config.Random(), bits)
 	case packet.PubKeyAlgoEdDSA:
-		_, priv, err := ed25519.GenerateKey(config.Random())
+		curve := ecc.FindEdDSAByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+
+		priv, err := eddsa.GenerateKey(config.Random(), curve)
 		if err != nil {
 			return nil, err
 		}
-		return &priv, nil
+		return priv, nil
+	case packet.PubKeyAlgoECDSA:
+		curve := ecc.FindECDSAByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+
+		priv, err := ecdsa.GenerateKey(config.Random(), curve)
+		if err != nil {
+			return nil, err
+		}
+		return priv, nil
 	default:
 		return nil, errors.InvalidArgumentError("unsupported public key algorithm")
 	}
@@ -281,14 +282,18 @@ func newDecrypter(config *packet.Config) (decrypter interface{}, err error) {
 			return generateRSAKeyWithPrimes(config.Random(), 2, bits, primes)
 		}
 		return rsa.GenerateKey(config.Random(), bits)
-	case packet.PubKeyAlgoEdDSA:
-		fallthrough // When passing EdDSA, we generate an ECDH subkey
+	case packet.PubKeyAlgoEdDSA, packet.PubKeyAlgoECDSA:
+		fallthrough // When passing EdDSA or ECDSA, we generate an ECDH subkey
 	case packet.PubKeyAlgoECDH:
 		var kdf = ecdh.KDF{
 			Hash:   algorithm.SHA512,
 			Cipher: algorithm.AES256,
 		}
-		return ecdh.X25519GenerateKey(config.Random(), kdf)
+		curve := ecc.FindECDHByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+		return ecdh.GenerateKey(config.Random(), curve, kdf)
 	default:
 		return nil, errors.InvalidArgumentError("unsupported public key algorithm")
 	}