build(deps): update Bouncy Castle to 1.86 and PGPainless to 1.7.8

Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479,
GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all
fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root
resolution rule keeps every Bouncy Castle module on the catalog version;
before, bcpg 1.77 shipped next to bcprov 1.78.1.

The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by
default, which the old one rejected as "non-standard AEAD". Drop the
NonStandardAEAD error, its bottom sheet and strings, and replace the
mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message
encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message
that the tests now decrypt. The new fixture is a throwaway test key, so
it is allowlisted in .gitleaksignore by fingerprint.

Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so
accepted every key that parsed, including keys with no encryption
subkey. A signing-only key fixture now covers the rejection path.

Also: migrate the removed SelectUserId.firstMatch and deprecated
addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle
META-INF/LICENSE.md in the APK, and move the existing InvalidPackage
lint baseline entries to the bcpkix 1.86 jar.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

8 files changed, 8 insertions, 33 deletions

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 90294283..206a3972 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -28,7 +28,11 @@ android {
 
   androidResources { generateLocaleConfig = true }
 
-  packaging { resources.excludes.add("META-INF/versions/**") }
+  packaging {
+    resources.excludes.add("META-INF/versions/**")
+    // Every Bouncy Castle jar ships the same license file; keep one copy in the APK.
+    resources.pickFirsts.add("META-INF/LICENSE.md")
+  }
 }
 
 dependencies {
diff --git a/app/lint-baseline.xml b/app/lint-baseline.xml
index a8a3f662..8feed974 100644
--- a/app/lint-baseline.xml
+++ b/app/lint-baseline.xml
@@ -5,14 +5,14 @@
         id="InvalidPackage"
         message="Invalid package reference in library; not included in Android: `javax.naming.directory`. Referenced from `org.bouncycastle.cert.dane.fetcher.JndiDANEFetcherFactory`.">
         <location
-            file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.bouncycastle/bcpkix-jdk18on/1.78.1/17b3541f736df97465f87d9f5b5dfa4991b37bb3/bcpkix-jdk18on-1.78.1.jar"/>
+            file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.bouncycastle/bcpkix-jdk18on/1.86/fb5ea65959db10fe5d61148bb2b77f6e231455b1/bcpkix-jdk18on-1.86.jar"/>
     </issue>
 
     <issue
         id="InvalidPackage"
         message="Invalid package reference in library; not included in Android: `javax.naming`. Referenced from `org.bouncycastle.cert.dane.fetcher.JndiDANEFetcherFactory.1`.">
         <location
-            file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.bouncycastle/bcpkix-jdk18on/1.78.1/17b3541f736df97465f87d9f5b5dfa4991b37bb3/bcpkix-jdk18on-1.78.1.jar"/>
+            file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.bouncycastle/bcpkix-jdk18on/1.86/fb5ea65959db10fe5d61148bb2b77f6e231455b1/bcpkix-jdk18on-1.86.jar"/>
     </issue>
 
     <issue
diff --git a/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt b/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt
index 0d7f8dfb..8b2109bf 100644
--- a/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt
+++ b/app/src/main/java/app/passwordstore/ui/crypto/DecryptActivity.kt
@@ -15,13 +15,11 @@ import androidx.lifecycle.lifecycleScope
 import app.passwordstore.Application.Companion.screenWasOff
 import app.passwordstore.R
 import app.passwordstore.crypto.PGPIdentifier
-import app.passwordstore.crypto.errors.NonStandardAEAD
 import app.passwordstore.data.crypto.PGPPassphraseCache
 import app.passwordstore.data.passfile.PasswordEntry
 import app.passwordstore.data.password.FieldItem
 import app.passwordstore.databinding.DecryptLayoutBinding
 import app.passwordstore.ui.adapters.FieldItemAdapter
-import app.passwordstore.ui.dialogs.BasicBottomSheet
 import app.passwordstore.util.auth.BiometricAuthenticator
 import app.passwordstore.util.auth.BiometricAuthenticator.Result as BiometricResult
 import app.passwordstore.util.extensions.getString
@@ -255,24 +253,7 @@ class DecryptActivity : BasePGPActivity() {
       onSuccess()
     } else {
       logcat(ERROR) { result.error.stackTraceToString() }
-      when (result.error) {
-        is NonStandardAEAD -> {
-          BasicBottomSheet.Builder(this)
-            .setTitle(getString(R.string.aead_detect_title))
-            .setMessage(getString(R.string.aead_detect_message, result.error.message))
-            .setPositiveButtonClickListener(getString(R.string.dialog_ok)) {
-              setResult(RESULT_CANCELED)
-              finish()
-            }
-            .setOnDismissListener {
-              setResult(RESULT_CANCELED)
-              finish()
-            }
-            .build()
-            .show(supportFragmentManager, "AEAD_INFO_SHEET")
-        }
-        else -> decrypt(isError = true, authResult = authResult)
-      }
+      decrypt(isError = true, authResult = authResult)
     }
   }
 
diff --git a/app/src/main/res/values-de/strings.xml b/app/src/main/res/values-de/strings.xml
index 03576885..f577bd64 100644
--- a/app/src/main/res/values-de/strings.xml
+++ b/app/src/main/res/values-de/strings.xml
@@ -344,6 +344,4 @@
   <string name="no_keys_imported_dialog_title">Keine Schlüssel importiert</string>
   <string name="no_keys_imported_dialog_message">Es wurden noch keine PGP-Schlüssel in die App importiert. Wählen Sie eine Schlüsseldatei über die Schaltfläche \"Importieren\" aus.</string>
   <string name="biometric_prompt_title_gpg_passphrase_cache">Freischalten des Passphrase-Zwischenspeichers</string>
-  <string name="aead_detect_title">AEAD-Verschlüsselung festgestellt</string>
-  <string name="aead_detect_message">%1$s, siehe https://passwordstore.app/fix-aead für weiterführende Informationen.</string>
 </resources>
diff --git a/app/src/main/res/values-gl/strings.xml b/app/src/main/res/values-gl/strings.xml
index 791a6385..7d886c40 100644
--- a/app/src/main/res/values-gl/strings.xml
+++ b/app/src/main/res/values-gl/strings.xml
@@ -346,6 +346,4 @@ a app desde unha fonte de confianza, como a Play Store, Amazon Appstore, F-Droid
   <string name="no_keys_imported_dialog_title">Non se importaron chaves</string>
   <string name="no_keys_imported_dialog_message">Aínda non hai chaves PGP importadas na app, preme no botón inferior para seleccionar un ficheiro de chave</string>
   <string name="biometric_prompt_title_gpg_passphrase_cache">Desbloquear cache da frase de paso</string>
-  <string name="aead_detect_title">Detectada cifraxe AEAD</string>
-  <string name="aead_detect_message">%1$s, le https://passwordstore.app/fix-aead para ter máis información</string>
 </resources>
diff --git a/app/src/main/res/values-pl-rPL/strings.xml b/app/src/main/res/values-pl-rPL/strings.xml
index 3907a0e5..f85577c5 100644
--- a/app/src/main/res/values-pl-rPL/strings.xml
+++ b/app/src/main/res/values-pl-rPL/strings.xml
@@ -330,6 +330,4 @@
   <string name="activity_label_pgp_key_manager">Menedżer kluczy PGP</string>
   <string name="pgp_key_manager_delete_confirmation_dialog_title">Usunąć klucz?</string>
   <string name="git_utils_reset_remote_branch_title">Nazwa zdalnej gałęzi</string>
-  <string name="aead_detect_title">Wykryto szyfrowanie AEAD</string>
-  <string name="aead_detect_message">%1$s, zobacz https://passwordstore.app/fix-aead aby uzyskać więcej informacji</string>
 </resources>
diff --git a/app/src/main/res/values-pt-rBR/strings.xml b/app/src/main/res/values-pt-rBR/strings.xml
index 6f4b9ed9..0ba3d6eb 100644
--- a/app/src/main/res/values-pt-rBR/strings.xml
+++ b/app/src/main/res/values-pt-rBR/strings.xml
@@ -344,6 +344,4 @@
   <string name="no_keys_imported_dialog_title">Nenhuma chave importada</string>
   <string name="no_keys_imported_dialog_message">Não há chaves PGP importadas no aplicativo ainda, pressione o botão abaixo para escolher um arquivo de chave</string>
   <string name="biometric_prompt_title_gpg_passphrase_cache">Desbloquear cache da senha</string>
-  <string name="aead_detect_title">Criptografia AEAD detectada</string>
-  <string name="aead_detect_message">%1$s, consulte https://passwordstore.app/fix-aead para obter mais informações</string>
 </resources>
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index e03e5319..b3f3e71c 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -384,7 +384,5 @@
   <string name="no_keys_imported_dialog_title">No keys imported</string>
   <string name="no_keys_imported_dialog_message">There are no PGP keys imported in the app yet, press the button below to pick a key file</string>
   <string name="biometric_prompt_title_gpg_passphrase_cache">Unlock passphrase cache</string>
-  <string name="aead_detect_title">AEAD encryption detected</string>
-  <string name="aead_detect_message">%1$s, see https://passwordstore.app/fix-aead for more information</string>
   <string name="clear_cached_password_on_screen_off">Clear cached password on screen-off</string>
 </resources>