feat!: jwx v4 cutover and v0.6.0 (Go 1.27, ML-DSA) - #22
Merged
Conversation
Drop dual jwx v2/v3 support for a single NewJWSSigner/NewJWSVerifier path on lestrrat-go/jwx/v4, raise the Go floor to 1.27, and add an ML-DSA-65 foreign-JWS round-trip. Prepares httpsign v0.6.0. Co-authored-by: Cursor <cursoragent@cursor.com>
Reject key/alg mismatches at NewJWS* construction, document SetAllowedAlgs vs foreign JWS, and move lint to v2.13.1 so CI can target go.mod 1.27.0. Track upstream jwx ECDSA/ML-DSA AlgorithmsForKey gaps for later. Co-authored-by: Cursor <cursoragent@cursor.com>
Upgrade httpsfv to v1.1.1 and testify to v1.12.1. Drop andreyvit/diff in favor of sergi/go-diff plus a local CharacterDiff-style test helper. Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the hardening follow-up notes now that reports were filed privately/upstream. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the deprecated jws.AlgorithmsForKey check with explicit stdlib type checks in jwskey.go, including RFC 7518 ECDSA curve and HMAC key-length binding plus ML-DSA parameter-set matching at NewJWS* construction. Co-authored-by: Cursor <cursoragent@cursor.com>
Enforce asymmetric key role at NewJWSSigner/NewJWSVerifier construction so mismatches fail early instead of at Sign/Verify time. Co-authored-by: Cursor <cursoragent@cursor.com>
Reject nil ECDSA curves at JWS key validation and in raw sign/verify paths, and return errors instead of panicking when a header map entry has no values. Co-authored-by: Cursor <cursoragent@cursor.com>
Default nil ClientConfig in NewClient and return errors from sign/verify paths instead of panicking when Signer or Verifier config is unset. Co-authored-by: Cursor <cursoragent@cursor.com>
Document jwx v4 migration, ML-DSA foreign JWS usage, and SignAlg/SetAllowedAlgs for v0.6.0 callers. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github.com/lestrrat-go/jwx/v4(≥ v4.4.0) only; remove jwx v2/v3 andNewJWSSignerV3/NewJWSVerifierV3.crypto/mldsaandNewJWSSigner/NewJWSVerifier.jwskey.goconstructor validation (key type/role, ECDSA curve bind, HMAC min length); rejectNoSignature.internal-docs/RELEASE-v0.6.0.mdfor the GitHub release, CI golangci-lint v2.13.1.Made with Cursor