Update to Mocha v10 in tests, declare lib as module and add exports to package.json

Mocha v10 requires the lib to be esm compliant.
ESM mandates the use of file extensions in imports, so to minimize the
changes (for now), we rely on the flag `experimental-specifier-resolution=node`
and on `ts-node` (needed only for Node 20).

Breaking changes:
downstream bundlers might be affected by the package.json changes depending on
how they load the library.
NB: legacy package.json entrypoints are still available.

test/security/index.js

@@ -1,6 +1,11 @@
-module.exports = () => describe('Security', function () {
-  require('./message_signature_bypass')();
-  require('./unsigned_subpackets')();
-  require('./subkey_trust')();
-  require('./preferred_algo_mismatch')();
+import testMessageSignatureBypess from './message_signature_bypass';
+import testUnsignedSubpackets from './unsigned_subpackets';
+import testSubkeyTrust from './subkey_trust';
+import testPreferredAlgoMismatch from './preferred_algo_mismatch';
+
+export default () => describe('Security', function () {
+  testMessageSignatureBypess();
+  testUnsignedSubpackets();
+  testSubkeyTrust();
+  testPreferredAlgoMismatch();
 });

test/security/message_signature_bypass.js

@@ -1,8 +1,9 @@
-const { use: chaiUse, expect } = require('chai');
-chaiUse(require('chai-as-promised'));
+import { use as chaiUse, expect } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
+chaiUse(chaiAsPromised);
 
-const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../..');
-const util = require('../../src/util');
+const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : await import('openpgp');
+import util from '../../src/util.js';
 
 const { readKey, readCleartextMessage, SignaturePacket } = openpgp;
 
@@ -101,4 +102,4 @@ async function fakeSignature() {
   expect(signatures).to.have.length(0);
 }
 
-module.exports = () => it('Does not accept non-binary/text signatures', fakeSignature);
+export default () => it('Does not accept non-binary/text signatures', fakeSignature);

test/security/preferred_algo_mismatch.js

@@ -1,7 +1,8 @@
-const { use: chaiUse, expect } = require('chai');
-chaiUse(require('chai-as-promised'));
+import { use as chaiUse, expect } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
+chaiUse(chaiAsPromised);
 
-const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../..');
+const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : await import('openpgp');
 
 const armoredMessage = `-----BEGIN PGP MESSAGE-----
 Version: OpenPGP.js VERSION
@@ -38,7 +39,7 @@ EnxUPL95HuMKoVkf4w==
 =oopr
 -----END PGP PRIVATE KEY BLOCK-----`;
 
-module.exports = () => it('Does not accept message encrypted with algo not mentioned in preferred algorithms', async function() {
+export default () => it('Does not accept message encrypted with algo not mentioned in preferred algorithms', async function() {
   const message = await openpgp.readMessage({ armoredMessage });
   const privKey = await openpgp.readKey({ armoredKey: privateKeyArmor });
   await expect(openpgp.decrypt({ message, decryptionKeys: [privKey] })).to.be.rejectedWith('A non-preferred symmetric algorithm was used.');

test/security/subkey_trust.js

@@ -1,7 +1,9 @@
-const { use: chaiUse, expect } = require('chai');
-chaiUse(require('chai-as-promised'));
+import { use as chaiUse, expect } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
 
-const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../..');
+chaiUse(chaiAsPromised);
+
+const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : await import('openpgp');
 
 const { readKey, PublicKey, readCleartextMessage, createCleartextMessage, enums, PacketList, SignaturePacket } = openpgp;
 
@@ -33,7 +35,7 @@ async function generateTestData() {
   };
 }
 
-module.exports = () => it('Does not trust subkeys without Primary Key Binding Signature', async function() {
+export default () => it('Does not trust subkeys without Primary Key Binding Signature', async function() {
   // attacker only has his own private key,
   // the victim's public key and a signed message
   const { victimPubKey, attackerPrivKey, signed } = await generateTestData();

test/security/unsigned_subpackets.js

@@ -1,7 +1,9 @@
-const { use: chaiUse, expect } = require('chai');
-chaiUse(require('chai-as-promised'));
+import { use as chaiUse, expect } from 'chai';
+import chaiAsPromised from 'chai-as-promised';
 
-const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../..');
+chaiUse(chaiAsPromised);
+
+const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : await import('openpgp');
 
 const { readKey, PrivateKey, createMessage, enums, PacketList, SignaturePacket } = openpgp;
 
@@ -89,4 +91,4 @@ async function makeKeyValid() {
   expect(await encryptFails(modifiedkey)).to.be.true;
 }
 
-module.exports = () => it('Does not accept unsigned subpackets', makeKeyValid);
+export default () => it('Does not accept unsigned subpackets', makeKeyValid);