From 0a88fed76e2ba37a8d98a777a9e95f18f40ea00f Mon Sep 17 00:00:00 2001
From: Paul Schaub <vanitasvitae@fsfe.org>
Date: Tue, 21 Oct 2025 17:11:50 +0200
Subject: [PATCH 1/2] OpenPGPKey.getSecretKeys(): Preserve order of keys

---
 .../main/java/org/bouncycastle/openpgp/api/OpenPGPKey.java  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPKey.java b/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPKey.java
index dfab4226b2..4bb5a98f35 100644
--- a/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPKey.java
+++ b/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPKey.java
@@ -3,8 +3,8 @@
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.util.Date;
-import java.util.HashMap;
 import java.util.Iterator;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -74,7 +74,7 @@ public OpenPGPKey(PGPSecretKeyRing keyRing, OpenPGPImplementation implementation
         super(keyRing, implementation, policy);
 
         // Process and map secret keys
-        this.secretKeys = new HashMap<KeyIdentifier, OpenPGPSecretKey>();
+        this.secretKeys = new LinkedHashMap<KeyIdentifier, OpenPGPSecretKey>();
         for (Iterator it = getKeys().iterator(); it.hasNext(); )
         {
             OpenPGPComponentKey key = (OpenPGPComponentKey)it.next();
@@ -147,7 +147,7 @@ public OpenPGPSecretKey getPrimarySecretKey()
      */
     public Map<KeyIdentifier, OpenPGPSecretKey> getSecretKeys()
     {
-        return new HashMap<KeyIdentifier, OpenPGPSecretKey>(secretKeys);
+        return new LinkedHashMap<KeyIdentifier, OpenPGPSecretKey>(secretKeys);
     }
 
     /**

From 7592e7e21cfbee2d1cc804068da1e64a6c7a922b Mon Sep 17 00:00:00 2001
From: Paul Schaub <vanitasvitae@fsfe.org>
Date: Tue, 21 Oct 2025 17:12:22 +0200
Subject: [PATCH 2/2] OpenPGPCertificate.getPublicKeys(): Preserve order of
 items

---
 .../java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java  | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java b/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java
index 267cfd72ce..7a57651e6b 100644
--- a/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java
+++ b/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java
@@ -7,7 +7,6 @@
 import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.Date;
-import java.util.HashMap;
 import java.util.Iterator;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -183,7 +182,7 @@ public List<OpenPGPUserId> getValidUserIds(Date evaluationTime)
      */
     public Map<KeyIdentifier, OpenPGPComponentKey> getPublicKeys()
     {
-        Map<KeyIdentifier, OpenPGPComponentKey> keys = new HashMap<KeyIdentifier, OpenPGPComponentKey>();
+        Map<KeyIdentifier, OpenPGPComponentKey> keys = new LinkedHashMap<KeyIdentifier, OpenPGPComponentKey>();
         keys.put(primaryKey.getKeyIdentifier(), primaryKey);
         keys.putAll(subkeys);
         return keys;