Repository: chanzuckerberg/fogg
Pull request #857 (2023-05-11 20:55:39)

chore: Bump github.com/cloudflare/circl from 1.3.1 to 1.3.3
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.1 to 1.3.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's releases</a>.</em></p>
<blockquote>
<h2>CIRCL v1.3.3</h2>
<h2>New Features</h2>
<ul>
<li><a href="https://ascon.iaik.tugraz.at/">ASCON</a> light-weight authenticated encryption.</li>
<li>Hybrid KEM for HPKE based on Kyber and X25519.</li>
<li>CIRCL can be compiled both as static and dynamic linking modes.</li>
</ul>
<h2>Security</h2>
<ul>
<li>Fixes error-handling on rand readers.</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Use untyped consts for Kyber params by <a href="https://github.com/tmthrgd"><code>@​tmthrgd</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/398">cloudflare/circl#398</a></li>
<li>zk/dl: adds prefixed labels and updates nomenclature. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/396">cloudflare/circl#396</a></li>
<li>Bumping Go version. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/399">cloudflare/circl#399</a></li>
<li>kem: add P-256 + Kyber768Draft00 hybrid by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/402">cloudflare/circl#402</a></li>
<li>ckem: pass xof to elliptic.GenerateKey directly by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/403">cloudflare/circl#403</a></li>
<li>Adding Ascon, an AEAD lightweight cipher. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/400">cloudflare/circl#400</a></li>
<li>Add Ascon-80pq to cipher\ascon by <a href="https://github.com/dhcgn"><code>@​dhcgn</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/404">cloudflare/circl#404</a></li>
<li>ascon: update formulas and check for API compatibility by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/406">cloudflare/circl#406</a></li>
<li>all: enables dynamic linking, removes R15 is clobbered by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/407">cloudflare/circl#407</a></li>
<li>ascon: Removes table of constants. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/408">cloudflare/circl#408</a></li>
<li>tkn20: prevent panics on key gen errors by <a href="https://github.com/tmthrgd"><code>@​tmthrgd</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/409">cloudflare/circl#409</a></li>
<li>expander,tkn20: remove superfluous Reset calls by <a href="https://github.com/tmthrgd"><code>@​tmthrgd</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/410">cloudflare/circl#410</a></li>
<li>Updating stdlib crypto library. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/413">cloudflare/circl#413</a></li>
<li>Reduce x/crypto and x/sys versions to match Go 1.20 by <a href="https://github.com/Lekensteyn"><code>@​Lekensteyn</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/414">cloudflare/circl#414</a></li>
<li>Make ascon cipher go routine safe by <a href="https://github.com/enj"><code>@​enj</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/416">cloudflare/circl#416</a></li>
<li>tkn20,kyber,x25519,x448: plug constant-time leaks by <a href="https://github.com/tmthrgd"><code>@​tmthrgd</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/411">cloudflare/circl#411</a></li>
<li>Check for crypto/rand errors and ReadFull io.Readers by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/417">cloudflare/circl#417</a></li>
<li>Fix encapsulation seed size by <a href="https://github.com/chris-wood"><code>@​chris-wood</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/419">cloudflare/circl#419</a></li>
<li>Add X25519Kyber768Draft00 experimental HPKE KEM by <a href="https://github.com/chris-wood"><code>@​chris-wood</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/421">cloudflare/circl#421</a></li>
<li>hpke: Adding NonceSize function to AEAD. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/424">cloudflare/circl#424</a></li>
<li>hpke: Address always nil parameter. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/425">cloudflare/circl#425</a></li>
<li>hpke: update and move xyber768d00 test vectors by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/426">cloudflare/circl#426</a></li>
<li>hpke: fix encapsulation seed in test for xyber by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/428">cloudflare/circl#428</a></li>
<li>Remove scalar sha3 amd64 assembly by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/429">cloudflare/circl#429</a></li>
<li>Add HPKE benchmarks by <a href="https://github.com/chris-wood"><code>@​chris-wood</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/434">cloudflare/circl#434</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tmthrgd"><code>@​tmthrgd</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/398">cloudflare/circl#398</a></li>
<li><a href="https://github.com/dhcgn"><code>@​dhcgn</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/404">cloudflare/circl#404</a></li>
<li><a href="https://github.com/Lekensteyn"><code>@​Lekensteyn</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/414">cloudflare/circl#414</a></li>
<li><a href="https://github.com/enj"><code>@​enj</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/416">cloudflare/circl#416</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.3.2...v1.3.3">https://github.com/cloudflare/circl/compare/v1.3.2...v1.3.3</a></p>
<h2>CIRCL v1.3.2</h2>
<h2>What's Changed</h2>
<ul>
<li>oprf: Updating test vectors for VOPRF rc-rfc. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/388">cloudflare/circl#388</a></li>
<li>abe: Make golden files for cpabe. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/392">cloudflare/circl#392</a></li>
<li>abe: Improve test clarity by <a href="https://github.com/tanyav2"><code>@​tanyav2</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/393">cloudflare/circl#393</a></li>
<li>tkn20: change seed size for MAC key from 128-&gt;448 bits in accordance … by <a href="https://github.com/tanyav2"><code>@​tanyav2</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/394">cloudflare/circl#394</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cloudflare/circl/commit/3bef500f2b925f150815a360b90081021e082939"><code>3bef500</code></a> Releasing CIRCL v1.3.3</li>
<li><a href="https://github.com/cloudflare/circl/commit/4002bafcebdd3b32974f70cf86a4682f82d9b3b5"><code>4002baf</code></a> Add HPKE benchmarks</li>
<li><a href="https://github.com/cloudflare/circl/commit/795540340d5c79e5768a0135741cd7c3e5f7de93"><code>7955403</code></a> Remove scalar sha3 amd64 assembly</li>
<li><a href="https://github.com/cloudflare/circl/commit/aef72508ab9bf35177e84ae23f94170f4546b63e"><code>aef7250</code></a> hpke: fix encapsulation seed in test for xyber</li>
<li><a href="https://github.com/cloudflare/circl/commit/808526a555262691f406ceed2ac1e4e7421faf96"><code>808526a</code></a> hpke: update and move xyber768d00 test vectors</li>
<li><a href="https://github.com/cloudflare/circl/commit/c7845aa1035e0b2d0397663e0adc283fd16af50a"><code>c7845aa</code></a> Address always nil parameter.</li>
<li><a href="https://github.com/cloudflare/circl/commit/2475a3f4a6255da8795b2a8f0ec7e71e3ee6d37e"><code>2475a3f</code></a> Adding NonceSize function to AEAD.</li>
<li><a href="https://github.com/cloudflare/circl/commit/eaec71f4cccf05035481b034b8ce9dc8755118ec"><code>eaec71f</code></a> Add X25519Kyber768Draft00 experimental HPKE KEM</li>
<li><a href="https://github.com/cloudflare/circl/commit/f0db2881a9618356223ed31090cdb33feb1e6d23"><code>f0db288</code></a> Fix encapsulation seed size</li>
<li><a href="https://github.com/cloudflare/circl/commit/f4c0e87526ec17305e8a573f1c58acedc5539a92"><code>f4c0e87</code></a> Update go-ristretto dep</li>
<li>Additional commits viewable in <a href="https://github.com/cloudflare/circl/compare/v1.3.1...v1.3.3">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/cloudflare/circl&package-manager=go_modules&previous-version=1.3.1&new-version=1.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/chanzuckerberg/fogg/network/alerts).

</details>


Patch:
diff --git a/go.mod b/go.mod
index 86ccf55c..e4f6eef1 100644
--- a/go.mod
+++ b/go.mod
@@ -60,7 +60,7 @@ require (
 	github.com/apparentlymart/go-versions v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/bmatcuk/doublestar v1.3.4 // indirect
-	github.com/cloudflare/circl v1.3.1 // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/go-git/gcfg v1.5.0 // indirect
 	github.com/go-git/go-billy/v5 v5.4.1 // indirect
diff --git a/go.sum b/go.sum
index 2c1f1249..d0727a9b 100644
--- a/go.sum
+++ b/go.sum
@@ -288,8 +288,8 @@ github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5P
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
-github.com/cloudflare/circl v1.3.1 h1:4OVCZRL62ijwEwxnF6I7hLwxvIYi3VaZt8TflkqtrtA=
-github.com/cloudflare/circl v1.3.1/go.mod h1:+CauBF6R70Jqcyl8N2hC8pAXYbWkGIezuSbuGLtRhnw=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
diff --git a/templates/templates/.github/workflows/fogg_ci.yml.tmpl b/templates/templates/.github/workflows/fogg_ci.yml.tmpl
index 9229289e..9e9f6581 100644
--- a/templates/templates/.github/workflows/fogg_ci.yml.tmpl
+++ b/templates/templates/.github/workflows/fogg_ci.yml.tmpl
@@ -35,8 +35,10 @@ jobs:
         with:
           path: ~/.fogg/cache
           key: fogg-cache-{{`${{ hashFiles('**/.fogg-version') }}`}}
-      - run: make setup
-      - run: ssh-keyscan -H github.com >> ~/.ssh/known_hosts
+      - run: make setup      
+      - run: |
+          mkdir -p ~/.ssh/
+          ssh-keyscan -H github.com >> ~/.ssh/known_hosts
       {{- if not (eq (len $githubActionsCI.SSHKeySecrets) 0) }}
       - name: Install SSH key
         uses: webfactory/ssh-agent@v0.4.1


Test patch:
diff --git a/testdata/github_actions/.github/workflows/fogg_ci.yml b/testdata/github_actions/.github/workflows/fogg_ci.yml
index ea72f6be..188bdb2d 100644
--- a/testdata/github_actions/.github/workflows/fogg_ci.yml
+++ b/testdata/github_actions/.github/workflows/fogg_ci.yml
@@ -27,8 +27,10 @@ jobs:
         with:
           path: ~/.fogg/cache
           key: fogg-cache-${{ hashFiles('**/.fogg-version') }}
-      - run: make setup
-      - run: ssh-keyscan -H github.com >> ~/.ssh/known_hosts
+      - run: make setup      
+      - run: |
+          mkdir -p ~/.ssh/
+          ssh-keyscan -H github.com >> ~/.ssh/known_hosts
       - run: .fogg/bin/fogg apply
         env:
           FOGG_GITHUBAPPTOKEN: ${{ steps.generate_token.outputs.token }}
diff --git a/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml b/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml
index cf5801fc..97182fb0 100644
--- a/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml
+++ b/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml
@@ -27,8 +27,10 @@ jobs:
         with:
           path: ~/.fogg/cache
           key: fogg-cache-${{ hashFiles('**/.fogg-version') }}
-      - run: make setup
-      - run: ssh-keyscan -H github.com >> ~/.ssh/known_hosts
+      - run: make setup      
+      - run: |
+          mkdir -p ~/.ssh/
+          ssh-keyscan -H github.com >> ~/.ssh/known_hosts
       - name: Install SSH key
         uses: webfactory/ssh-agent@v0.4.1
         with: