update

.dependabot/config.yml

@@ -1,6 +1,23 @@
 ---
-version: 1
-update_configs:
-- package_manager: "go:modules"
+version: 2
+updates:
+- package-ecosystem: gomod
   directory: "/"
-  update_schedule: "daily"
+  schedule:
+    interval: daily
+  allow:
+  # Allow both direct and indirect updates for all packages
+  - dependency-type: "all"
+  # group all minor and patch dependency updates together
+  groups:
+    go-modules:
+      patterns:
+      - "*"
+      update-types:
+      - "minor"
+      - "patch"
+      exclude-patterns:
+      - "github.com/anchore/stereoscope"
+      - "github.com/testcontainers/testcontainers-go"
+      - "github.com/docker/docker"
+      - "github.com/containerd/containerd"

dependency/retrieval/go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.1.1
 	github.com/joshuatcasey/libdependency v0.19.0
 	github.com/paketo-buildpacks/packit/v2 v2.5.0
-	golang.org/x/crypto v0.21.0
+	golang.org/x/crypto v0.17.0
 )
 
 require (
@@ -42,13 +42,13 @@ require (
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/tools v0.13.0 // indirect
 	gonum.org/v1/gonum v0.7.0 // indirect
 	gopkg.in/neurosnap/sentences.v1 v1.0.6 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )
 
-replace github.com/joshuatcasey/libdependency => github.com/joshuatcasey/libdependency-fork v0.0.0-20220921223453-d14f66e8745c
+replace github.com/joshuatcasey/libdependency => github.com/joshuatcasey/libdependency-fork v0.0.0-20220921223453-d14f66e8745c

dependency/retrieval/retrieve.go

@@ -158,10 +158,12 @@ func getGPGKeys() ([]string, error) {
 	var nginxGPGKeys []string
 	for _, keyURL := range []string{
 		// Key URLs from https://nginx.org/en/pgp_keys.html
-		"http://nginx.org/keys/mdounin.key",
-		"http://nginx.org/keys/maxim.key",
-		"http://nginx.org/keys/sb.key",
-		"http://nginx.org/keys/thresh.key",
+		"http://nginx.org/keys/maxim.key",          // Maxim Konovalov’s PGP public key
+		"http://nginx.org/keys/arut.key",           // Roman Arutyunyan's PGP public key
+		"https://nginx.org/keys/pluknet.key",       // Sergey Kandaurov’s PGP public key
+		"http://nginx.org/keys/sb.key",             // Sergey Budnevitch’s PGP public key
+		"http://nginx.org/keys/thresh.key",         // Konstantin Pavlov’s PGP public key
+		"https://nginx.org/keys/nginx_signing.key", // nginx public key
 	} {
 		body, err := httpGet(keyURL)
 		if err != nil {
@@ -231,4 +233,4 @@ func decompress(artifact io.Reader, destination string) error {
 	}
 
 	return nil
-}
+}