Filippo Valsorda

This is still a problem, and not being able to use `stable` or `1.14.x` means not getting security updates from minor Go releases automatically.

Hello @bleichenbacher-daniel, on September 30 we had a multi-hour call in which I explained that Wycheproof (originally a Google project) was transferred by Google to C2SP with a mandate to...

Wonderful, thank you! I rebased that commit on the latest Copybara export to avoid confusion, and tagged it `google-wycheproof/v0.9` (based on https://github.com/C2SP/wycheproof/blob/google-wycheproof/v0.9/src/test_vector.py#L285-L288) to have a stable reference for it, and...

I'm afraid the file might be corrupted or truncated. age refuses to decrypt these files for security reasons. I've been planning to add an age-recovery binary for *insecurely* decrypting damaged...

Hey, I tried to work on this, but it looks like the source of `js/net-viel.js` is not available in the repository, so I wasn't able to make the changes that...

Yeah, might be useful, but meanwhile the id is on the precedent output line, no?

Thank you for the thorough report! Indeed, it looks like `tlog.FormatRecord` reflects the `/lookup` format but not the sumdb data tiles. I think the x/mod/sumdb package should mirror the sum.golang.org...

We should refuse to Sign and Verify with invalid keys, as long as the checks are not too expensive compared to the rest of the operation. I'd take a PR...

We are just using the weak package, so I think this is a decision for the @golang/runtime team. If storing values in non-Go allocated memory is a supported use case,...

I prefer to avoid as much as possible divergence between FIPS and non-FIPS mode. If we start accruing small little codepath differences, eventually it will get confusing to reason about...