PGPainless 1.0.5

CHANGELOG.md

@@ -5,6 +5,9 @@ SPDX-License-Identifier: CC0-1.0
 
 # PGPainless Changelog
 
+## 1.0.5
+- Security: Fix `KeyRingInfo.getValidAndExpiredUserIds()` accidentally including unbound user-ids
+
 ## 1.0.4
 - Yet another patch for faulty ASCII armor detection 😒
 

README.md

@@ -186,7 +186,7 @@ repositories {
 }
 
 dependencies {
-	implementation 'org.pgpainless:pgpainless-core:1.0.4'
+	implementation 'org.pgpainless:pgpainless-core:1.0.5'
 }
 ```
 

pgpainless-core/src/main/java/org/pgpainless/key/info/KeyRingInfo.java

@@ -346,6 +346,11 @@ public class KeyRingInfo {
             PGPSignature certification = signatures.userIdCertifications.get(userId);
             PGPSignature revocation = signatures.userIdRevocations.get(userId);
 
+            // Unbound user-id
+            if (certification == null) {
+                continue;
+            }
+
             // Not revoked -> valid
             if (revocation == null) {
                 probablyExpired.add(userId);

version.gradle

@@ -5,7 +5,7 @@
 allprojects {
     ext {
         shortVersion = '1.0.5'
-        isSnapshot = true
+        isSnapshot = false
         pgpainlessMinAndroidSdk = 10
         javaSourceCompatibility = 1.8
         bouncyCastleVersion = '1.70'