internal/releasesjson: replace deprecated openpgp dependency

[rolandshoemaker]

Switches away from the deprecated, unmaintained golang.org/x/crypto/openpgp module, and replaces it with the (mostly) drop-in, maintained, github.com/ProtonMail/go-crypto/openpgp.

This is part of a wider effort by the Go Security team to remove uses of golang.org/x/crypto/openpgp from the Go ecosystem.

[radeksimko]

Hi @rolandshoemaker
Thanks for the note and for the PR!

This looks reasonable to me. I am just asking internally to see if we have consensus on the replacement to use within HashiCorp and also to nudge other projects to replace it.

[radeksimko]

There is currently no consensus, mostly because the two libraries aren't entirely equivalent.

For example, the ProtonMail implementation brings in support for ECC keys - whether or not we want that is a separate conversation to have, maybe as part of hashicorp/terraform#32056

That said, this concerns mostly Terraform providers - which hc-install is not designed to install - and the tooling we use to sign artifacts which end up at releases.hashicorp.com already uses the same ProtonMail library, even though it may not actually sign via ECC keys or use all the features which the library offers. Without judging the decision or the feature set, there is a valid argument about aligning the two IMO.

This is not the same argument one can make about your other PR though hashicorp/terraform#33131 - the situation there will require some further conversations, especially with the Terraform Registry team.

I hope the context is helpful.