Bump org.pgpainless:pgpainless-core from 2.0.3 to 2.0.4

[dependabot]

Bumps org.pgpainless:pgpainless-core from 2.0.3 to 2.0.4.

Release notes

Sourced from org.pgpainless:pgpainless-core's releases.

PGPainless-CLI 2.0.4

This release fixes a number of security and consistency issues.

Changelog

Sourced from org.pgpainless:pgpainless-core's changelog.

2.0.4

• Bump checkstyle tool version to 10.26.1
• Fix PGPainless silently dropping trailing 0xFF octet (Thanks to @​byteoverride for the report, suggested fix and regression test!)
• Manually bump transitive dependency plexus-utils of checkstyle to 3.6.1
• Fix missing enforcement for maximum packet nesting depth of compressed data packets in sop inline-detach (see advisory)
• Document user responsibility for not exposing decrypted data before successfully closing OpenPgpMessageInputStream
• Introduce PGPainless.verifyAndOpen() utility method (thanks to @​0xEr3n for early advise on hardening)
• Prevent accidental overwriting internal Policy instances when using multiple instances of PGPainless (see advisory)
• Prevent KOpenPGP-style attacks on several secret-key unlock code paths (see advisory)
• Fix RFC-4880-only encryption policy still emitting SEIPDv2/AEAD encrypted data (see advisory)
• Fix RFC-4880-only decryption policy still decrypting SEIPDv2/AEAD encrypted data (see advisory)
• Enforce compression algorithm policy while consuming compressed signed messages (see advisory)
• Use proper certification hash algorithm policy when checking subkey bindings (see advisory)
• Use proper revocation hash algorithm policy when checking revocation signatures (see advisory)
• Do not emit expired document signatures as valid (see advisory)
• Do not emit non-document signatures as valid (see advisory)
• Reject document signatures with mismatching IntendedRecipientFingerprint subpacket
• Properly handle tampered MDC-protected data (see advisory)
• Properly reject detached-signing with encrypt-only subkey (see advisory)
• Fix missing-key-flags fallback bypassing caller encryption subkey selector (see advisory)
• Fix hidden-recipient message decryption bypassing missing-key-flags check (see advisory)
• Chose proper user-id preferences when encrypting to certificate authenticated by CA (see advisory)
• Properly enforce maximum encrypted data packet nesting depth (see advisory)
• Fix NPE in interactive passphrase code-path when decrypting hidden-recipient messages (see advisory)
• Emit OnePassSignaturePackets using new packet format

Commits

• fdb0748 PGPainless 2.0.4
• 991c263 Update changelog
• c7eecf6 Emit OnePassSignatures using the new packet format
• 7c05c56 Checkstyle and formatting issues
• f8078cd Update changelog
• 003b7f3 Introduce max plaintext limit to PGPainless.verifyAndOpen() and add test
• 10a6315 Fix missing imports
• 2e2f4fc Merge commit from fork
• fb919e9 Test decryption of hidden recipient message with interactive passphrase callback
• 64bce18 SignatureBuilders: Choose proper HashAlgorithmPolicy instance, depending on s...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)