jsjws missing verifyJWSByNE

[adalinesimonian]

jsrsasign removed jsjws.verifyJWSByNE, which we use, in a minor release, violating semver.

This is causing failing tests and breaking functionality in connect-nodejs.

Either we wait for @kjur to release a fixed copy and pin the version of the jsrsasign dependency to an older version for now, or we find an alternative and replace jsrsasign now.

Either way, since these functions are deprecated, it sounds like we'll have to replace them eventually.

[EternalDeiwos]

Does any of the recent commits make use of any of the changes made in addition to the deprecation of JWSByNE? If not then can we not roll back the dependency version to a previous one?

[adalinesimonian]

We probably can and should. After further tests, it looks like this hiccup in jsrsasign prevents any token validation across the entire suite of Anvil software. I'm currently unable to set up and/or administrate any server without manually digging into node_modules and pinning jsrsasign to an older version.

[adalinesimonian]

What are alternatives to jsrsasign and/or new API paths available in jsrsasign that can replace the jsjws verification code currently in this repository?

[kjur]

jsrsasign 4.9.2 to 5.0.0 JWS API migration guide is now provided:
https://github.com/kjur/jsrsasign/wiki/jsrsasign-JWS-API-4.9.2-to-5.0.0-migration-guide

[adalinesimonian]

Thanks, @kjur!

PR #7 uses the new API.