Bump to Go 1.24 and account for the new crypto/rand behaviour.

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.22'
+        go-version: '1.24'
         check-latest: true
     - uses: actions/cache@v4
       with:
@@ -22,9 +22,6 @@ jobs:
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
-    - name: Install development dependencies
-      run: |
-        go install github.com/google/addlicense@latest
     - name: Build
       run: make
     - name: Test

.github/workflows/release.yml

@@ -14,11 +14,8 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.22'
+        go-version: '1.24'
         check-latest: true
-    - name: Install go-license-detector
-      run: |
-        go install go.elastic.co/go-licence-detector@latest
     - name: Install Cosign
       uses: sigstore/cosign-installer@v3
     - uses: aws-actions/configure-aws-credentials@v4

Makefile

@@ -5,9 +5,9 @@ GO_LDFLAGS = -s -w -X github.com/rstudio/rskey/cmd.Version=$(VERSION)
 GO_BUILD_ARGS = -v -trimpath
 
 GOPATH = $(shell go env GOPATH)
-ADDLICENSE = $(GOPATH)/bin/addlicense
+ADDLICENSE = go tool github.com/google/addlicense
 ADDLICENSE_ARGS = -v -s=only -l=apache -c "Posit Software, PBC" -ignore 'coverage*' -ignore '.github/**' -ignore '.goreleaser.yaml'
-NOTICETOOL = $(GOPATH)/bin/go-licence-detector
+NOTICETOOL = go tool go.elastic.co/go-licence-detector
 
 all: rskey
 

crypt/aes.go

@@ -17,34 +17,28 @@ const (
 )
 
 // EncryptFIPS produces base64-encoded cipher text for the given payload and key
-// using a FIPS-compatible algorithm, or an error if one cannot be created.
+// using a FIPS-compatible algorithm. It never returns an error.
 func (k *Key) EncryptFIPS(s string) (string, error) {
 	return k.EncryptBytesFIPS([]byte(s))
 }
 
 // EncryptBytesFIPS produces base64-encoded cipher text for the given bytes and
-// key using a FIPS-compatible algorithm, or an error if one cannot be created.
+// key using a FIPS-compatible algorithm. It never returns an error.
 func (k *Key) EncryptBytesFIPS(bytes []byte) (string, error) {
-	output, err := k.encryptAES(bytes)
-	if err != nil {
-		return "", err
-	}
-	return base64.StdEncoding.EncodeToString(output), nil
+	return base64.StdEncoding.EncodeToString(k.encryptAES(bytes)), nil
 }
 
-func (k *Key) encryptAES(bytes []byte) ([]byte, error) {
+func (k *Key) encryptAES(bytes []byte) []byte {
 	nonce := make([]byte, 12)
-	_, err := rand.Read(nonce)
-	if err != nil {
-		return []byte{}, err
-	}
-
+	// As of Go 1.24, rand.Read() aborts rather than returning an error.
+	// See: https://go.dev/issue/66821
+	_, _ = rand.Read(nonce)
 	aead := k.newAESGCM()
 	output := aead.Seal(nil, nonce, bytes, nil)
 	output = append(nonce, output...)
 	// Append a version prefix.
 	output = append([]byte{2}, output...)
-	return output, nil
+	return output
 }
 
 func (k *Key) decryptAES(buf []byte) ([]byte, error) {

crypt/key.go

@@ -39,11 +39,14 @@ var (
 // secret when encrypting data.
 type Key [KeyLength]byte
 
-// NewKey returns a newly-generated key, or an error if one cannot be generated.
+// NewKey returns a newly-generated key. It never returns an error, despite its
+// function signature.
 func NewKey() (*Key, error) {
 	var key Key
-	_, err := rand.Read(key[:])
-	return &key, err
+	// As of Go 1.24, rand.Read() aborts rather than returning an error.
+	// See: https://go.dev/issue/66821
+	_, _ = rand.Read(key[:])
+	return &key, nil
 }
 
 // NewKeyFromBytes returns the key read from the given byte slice, or an error.
@@ -111,12 +114,11 @@ func (k *Key) Encrypt(s string) (string, error) {
 // or an error if one cannot be created.
 func (k *Key) EncryptBytes(bytes []byte) (string, error) {
 	var output []byte
-	var err error
 	if FIPSMode {
-		output, err = k.encryptAES(bytes)
-	} else {
-		output, err = k.encryptSecretbox(bytes)
+		output := k.encryptAES(bytes)
+		return base64.StdEncoding.EncodeToString(output), nil
 	}
+	output, err := k.encryptSecretbox(bytes)
 	if err != nil {
 		return "", err
 	}

crypt/key_test.go

@@ -4,7 +4,6 @@
 package crypt
 
 import (
-	"crypto/rand"
 	"encoding/hex"
 	"fmt"
 	"strings"
@@ -83,16 +82,6 @@ RBgRUFc/JXLB8+dKlTJWEBF8BbBMW9Ej+eBNozE2IYs=`
 	_, err = NewKeyFromReader(&errReader{})
 	c.Check(err, check.Not(check.IsNil))
 	c.Check(err, check.ErrorMatches, `cannot read`)
-
-	// Swap out the standard library's crypto reader for the remainder of
-	// the tests so we can simulate a failure to generate random bits.
-	randReader := rand.Reader
-	rand.Reader = &errReader{}
-	defer func() { rand.Reader = randReader }()
-
-	k, err = NewKey()
-	c.Check(err, check.Not(check.IsNil))
-	c.Check(err, check.ErrorMatches, `cannot read`)
 }
 
 func (s *KeySuite) TestKeyRotation(c *check.C) {
@@ -141,16 +130,6 @@ func (s *KeySuite) TestEncryption(c *check.C) {
 	dupCipher, err := key.Encrypt("some secret")
 	c.Check(err, check.IsNil)
 	c.Check(dupCipher, check.Not(check.Equals), cipher)
-
-	// Swap out the standard library's crypto reader for the remainder of
-	// the tests so we can simulate a failure to generate random bits.
-	randReader := rand.Reader
-	rand.Reader = &errReader{}
-	defer func() { rand.Reader = randReader }()
-
-	_, err = key.Encrypt("some secret")
-	c.Check(err, check.Not(check.IsNil))
-	c.Check(err, check.ErrorMatches, `cannot read`)
 }
 
 func (s *KeySuite) TestVersionedEncryption(c *check.C) {
@@ -179,16 +158,6 @@ func (s *KeySuite) TestVersionedEncryption(c *check.C) {
 	dupCipher, err := key.encryptVersioned("some secret")
 	c.Check(err, check.IsNil)
 	c.Check(dupCipher, check.Not(check.Equals), cipher)
-
-	// Swap out the standard library's crypto reader for the remainder of
-	// the tests so we can simulate a failure to generate random bits.
-	randReader := rand.Reader
-	rand.Reader = &errReader{}
-	defer func() { rand.Reader = randReader }()
-
-	_, err = key.encryptVersioned("some secret")
-	c.Check(err, check.Not(check.IsNil))
-	c.Check(err, check.ErrorMatches, `cannot read`)
 }
 
 func (s *KeySuite) TestByteEncryption(c *check.C) {
@@ -232,16 +201,6 @@ func (s *KeySuite) TestFIPSEncryption(c *check.C) {
 	dupCipher, err := key.EncryptFIPS("some secret")
 	c.Check(err, check.IsNil)
 	c.Check(dupCipher, check.Not(check.Equals), cipher)
-
-	// Swap out the standard library's crypto reader for the remainder of
-	// the tests so we can simulate a failure to generate random bits.
-	randReader := rand.Reader
-	rand.Reader = &errReader{}
-	defer func() { rand.Reader = randReader }()
-
-	_, err = key.EncryptFIPS("some secret")
-	c.Check(err, check.Not(check.IsNil))
-	c.Check(err, check.ErrorMatches, `cannot read`)
 }
 
 func (s *KeySuite) TestFingerprint(c *check.C) {

crypt/nacl.go

@@ -24,10 +24,9 @@ const (
 
 func (k *Key) encryptSecretbox(bytes []byte) ([]byte, error) {
 	var nonce [24]byte
-	_, err := rand.Read(nonce[:])
-	if err != nil {
-		return []byte{}, err
-	}
+	// As of Go 1.24, rand.Read() aborts rather than returning an error.
+	// See: https://go.dev/issue/66821
+	_, _ = rand.Read(nonce[:])
 	output := secretbox.Seal(nil, bytes, &nonce, k.key32())
 	output = append(nonce[:], output...)
 	return output, nil

go.mod

@@ -1,6 +1,6 @@
 module github.com/rstudio/rskey
 
-go 1.17
+go 1.24
 
 require (
 	github.com/spf13/cobra v1.4.0
@@ -10,9 +10,22 @@ require (
 )
 
 require (
+	github.com/bmatcuk/doublestar/v4 v4.0.2 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.5 // indirect
+	github.com/google/addlicense v1.1.1 // indirect
+	github.com/google/licenseclassifier v0.0.0-20200402202327-879cb1424de0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/kr/pretty v0.2.1 // indirect
 	github.com/kr/text v0.1.0 // indirect
+	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	go.elastic.co/go-licence-detector v0.7.0 // indirect
+	golang.org/x/mod v0.20.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
 	golang.org/x/sys v0.28.0 // indirect
 )
+
+tool (
+	github.com/google/addlicense
+	go.elastic.co/go-licence-detector
+)

go.sum

@@ -1,84 +1,58 @@
+github.com/bmatcuk/doublestar/v4 v4.0.2 h1:X0krlUVAVmtr2cRoTqR8aDMrDqnB36ht8wpWTiQ3jsA=
+github.com/bmatcuk/doublestar/v4 v4.0.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/cyphar/filepath-securejoin v0.2.5 h1:6iR5tXJ/e6tJZzzdMc1km3Sa7RRIVBKAK32O2s7AYfo=
+github.com/cyphar/filepath-securejoin v0.2.5/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/addlicense v1.1.1 h1:jpVf9qPbU8rz5MxKo7d+RMcNHkqxi4YJi/laauX4aAE=
+github.com/google/addlicense v1.1.1/go.mod h1:Sm/DHu7Jk+T5miFHHehdIjbi4M5+dJDRS3Cq0rncIxA=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/licenseclassifier v0.0.0-20200402202327-879cb1424de0 h1:OggOMmdI0JLwg1FkOKH9S7fVHF0oEm8PX6S8kAdpOps=
+github.com/google/licenseclassifier v0.0.0-20200402202327-879cb1424de0/go.mod h1:qsqn2hxC+vURpyBRygGUuinTO42MFRLcsmQ/P8v94+M=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/spf13/cobra v1.4.0 h1:y+wJpx64xcgO1V+RcnwW0LEHxTKRi2ZDPSBjWnrg88Q=
 github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+go.elastic.co/go-licence-detector v0.7.0 h1:qC31sfyfNcNx/zMYcLABU0ac3MbGHZgksCAb5lMDUMg=
+go.elastic.co/go-licence-detector v0.7.0/go.mod h1:f5ty8pjynzQD8BcS+s0qtlOGKc35/HKQxCVi8SHhV5k=
 golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
+golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

workbench/workbench.go

@@ -72,9 +72,9 @@ func (k *Key) Encrypt(s string) (string, error) {
 	// incorrect for this algorithm, but works with OpenSSL. We generate
 	// only 16 bytes but match the length for use as a prefix later.
 	iv := make([]byte, 32)
-	if _, err := rand.Read(iv[:16]); err != nil {
-		return "", err
-	}
+	// As of Go 1.24, rand.Read() aborts rather than returning an error.
+	// See: https://go.dev/issue/66821
+	_, _ = rand.Read(iv[:16])
 	// CBC requires that the input have a length divisible by the block size
 	// (which is 16) or be padded to that length using PKCS#7 padding. This
 	// padding uses the padding length itself as the padding byte, so e.g.

workbench/workbench_test.go

@@ -106,19 +106,6 @@ func (s *WorkbenchSuite) TestEncryption(c *check.C) {
 	c.Check(len(c2), check.Not(check.Equals), len(c1))
 }
 
-func (s *WorkbenchSuite) TestEntropyFailure(c *check.C) {
-	// Swap out the standard library's crypto reader so we can simulate a
-	// failure to generate random bits.
-	randReader := rand.Reader
-	rand.Reader = &errReader{}
-	defer func() { rand.Reader = randReader }()
-
-	k, _ := NewKeyFromBytes([]byte(sampleKey))
-	_, err := k.Encrypt("some secret")
-	c.Check(err, check.Not(check.IsNil))
-	c.Check(err, check.ErrorMatches, `cannot read`)
-}
-
 func (s *WorkbenchSuite) TestFingerprint(c *check.C) {
 	key, err := NewKeyFromBytes([]byte(sampleKey))
 	c.Check(err, check.IsNil)