fix: replace unmaintained golang.org/x/crypto/openpgp with ProtonMail fork

[jmrplens]

Fixes #57.

Problem

validate.go imports golang.org/x/crypto/openpgp at file scope for the PGPValidator.KeyRing field. That package is frozen and deprecated (golang/go#44226) and carries GO-2026-5932, which has no fixed version — its affected range is introduced: 0 with Fixed in: N/A, because the finding is the package's unmaintained status rather than a specific defect.

Since Go cannot drop a package-level import, openpgp is linked into every binary that imports selfupdate, so all downstream consumers inherit the advisory even when they configure ChecksumValidator or ECDSAValidator and never verify a PGP signature.

Change

Migrate to github.com/ProtonMail/go-crypto/openpgp, the maintained fork recommended both by the advisory and by the x/crypto/openpgp package documentation:

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp, which is a maintained fork that aims to be a drop-in replacement for this package.

Three parts:

1. validate.go — swap the import. The fork's CheckDetachedSignature / CheckArmoredDetachedSignature take an additional *packet.Config; nil selects the library defaults and matches the behaviour of the functions being replaced.
2. go.mod — bump github.com/cloudflare/circl to v1.6.3. ProtonMail/go-crypto@v1.4.1 otherwise resolves circl v1.6.2, which is affected by GO-2026-4550 (incorrect secp384r1 CombinedMult calculation). Without this the change would trade one advisory for another.
3. Tests — migrate the imports in validate_test.go / mockdata_test.go, and relax one assertion (see below).

Net diff is 19 insertions / 8 deletions.

The relaxed assertion

TestPGPValidator/Fail asserted the exact error string:

assert.EqualError(t, err, "openpgp: invalid signature: hash tag doesn't match")

Both libraries reject the signature correctly; they differ in the reason reported after the prefix (x/crypto fails at the hash-tag fast path, ProtonMail reports RSA verification failure after the full check). The reason is an implementation detail of the openpgp library rather than part of this package's contract, so the assertion now pins the stable prefix:

assert.ErrorContains(t, err, "openpgp: invalid signature")

Verification

• go test ./... passes on all packages.
• golangci-lint run ./... reports 0 issues.
• Backward compatibility of existing signatures: I generated a key and an armored detached signature with golang.org/x/crypto/openpgp and verified them through the migrated PGPValidator — they validate correctly, and a tampered payload is still rejected. Release assets already signed with the previous implementation keep validating.
• Consumer impact: in a project that previously reported GO-2026-5932 through this module, govulncheck now reports No vulnerabilities found.

Compatibility note

PGPValidator.KeyRing is typed openpgp.EntityList, and that type now comes from a different package. Code that builds a key ring itself with x/crypto and assigns it to KeyRing directly will not compile until it updates its import:

cannot use ring (variable of slice type "golang.org/x/crypto/openpgp".EntityList)
as "github.com/ProtonMail/go-crypto/openpgp".EntityList value in struct literal

Code using the WithArmoredKeyRing([]byte) convenience method — which does not expose the type — is unaffected. I could not find a way to avoid this while still removing the dependency, since keeping the old type would require keeping the import. It probably warrants a minor version bump.

If you would prefer a different approach — for example moving the PGP validators into a separate package so consumers that do not use them never link openpgp — I am happy to rework this.