Skip to content

Releases: faustbrian/go-authentication

Release list

github.com/faustbrian/go-authentication v1.0.0

github.com/faustbrian/go-authentication v1.0.0 Latest
Latest

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:06
v1.0.0
9f3aa6f

1.0.0 - 2026-08-25

Fixed

  • Run OIDC Keycloak interoperability through the repository-owned standalone
    script instead of a removed monorepo-relative path.

Changed

  • Upgrade JWT cryptographic dependencies to their current secure releases.

  • Exclude intentional nested modules from root local-proxy archives so local,
    bootstrap, CI, and public module checksums describe the same source
    boundary.

  • Track the pinned documentation-tool lockfile so clean CI checkouts install
    the exact validated cspell dependency.

  • Reconcile standalone dependency checksums against deterministic current
    module archives so CI, local verification, and release consumers resolve
    identical content.

  • Harden standalone documentation validation with deterministic spelling and
    link checks, package-specific documentation gates, and repository-local
    contributor guidance.

Documentation

  • Replace obsolete standalone-repository links and workflow claims with
    monorepo-canonical targets and current release guidance.

  • Link the package README to the repository-wide Golib documentation portal.

Security

  • Protect static Basic and API-key credentials with random per-authenticator
    HMAC-SHA-256 keys instead of reusable unkeyed secret digests.
  • Enforce and prove inclusive credential, principal, challenge, collection, and
    static-entry bounds at their exact limits; reject forged result states and
    provider method mismatches without weakening fail-closed behavior.

Fixed

  • Bind package-owned composition and static-secret lifecycle decisions to the
    authoritative RFC authentication and credential-security constraints.
  • Return authentication unavailability instead of emitting a non-compliant
    401 Unauthorized response when no valid WWW-Authenticate challenge is
    available.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-authentication identity while preserving its documented API and behavior.

  • Replace obsolete owned-module pseudo-version pins with the monorepo's local
    v0.0.0 source-proxy coordinates; release tooling continues to emit exact
    v1.0.0 dependency versions.

  • Link specification provenance directly to the canonical decision register so
    conformance rationale and executable evidence remain discoverable.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Add explicit pipe-compatible bearer extraction for legacy opaque-token
    contracts while retaining strict RFC 6750 syntax by default.

  • Preserve apikey.Static comparability while retaining per-authenticator
    keyed credential digests.

  • Execute API compatibility tooling against the isolated module graph so owned
    dependency source changes cannot conflict with release checksums.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Use the repository-pinned current apidiff revision for root and optional
    authentication-module compatibility checks.

Added

  • An auditable specification decision register for Basic, bearer, API-key,
    challenge, credential-source, middleware, composition, and rotation policy.
  • Constant-work static bearer authentication with bounded overlapping tokens
    and atomic whole-set replacement for credential rotation and revocation.
  • Immutable bounded principals, typed redacted credentials, explicit anonymous
    results, stable failures, challenges, context helpers, and deterministic
    authenticator composition.
  • Constant-time static Basic and API-key authentication, atomic API-key
    rotation, and callback bearer and API-key adapters.
  • Strict opt-in HTTP header, query, and cookie extraction with fail-closed
    authentication-only middleware.
  • Optional JWT/JWK and OIDC modules with bounded remote key handling, strict
    algorithm and claim validation, rotation, stale-key behavior, and owned
    resource lifecycle.
  • Secret-safe slog and optional OpenTelemetry instrumentation adapters.
  • Deterministic test fixtures, runnable examples, fuzz targets, race tests,
    benchmarks, exact statement coverage gates, API compatibility checks, and
    reproducible release automation.
  • Security audit artifacts covering the threat model, findings, protocol and
    failure-injection matrices, authoritative vectors, and secure adoption.

Changed

  • OIDC remote refresh now has bounded cancellation-aware waiters, conditional
    requests, bounded freshness, failure cooldown, and consistent numeric-date
    skew enforcement.
  • JWT remote shutdown now owns, cancels, and drains admitted operations.
  • JWT and OIDC reject algorithm/key-family and JWK metadata mismatches.
  • Basic credentials and HTTP challenges reject control bytes, and challenges
    enforce explicit parameter and field bounds.
  • Query credential constructors are deprecated for new designs.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Assets 9
Loading

github.com/faustbrian/go-authentication/oidc v1.0.0

github.com/faustbrian/go-authentication/oidc v1.0.0

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:11
oidc/v1.0.0
9f3aa6f

1.0.0 - 2026-08-25

Documentation

  • Link the package README to the repository-wide Golib documentation portal.

Security

  • Reject duplicate discovery/JWKS members, invalid response media types,
    oversized headers, null or wrongly typed standard metadata, empty JWK
    operation policy, encryption-only keys, ambiguous missing key IDs,
    non-loopback HTTP providers, retired-key rollback, malformed standard JOSE
    headers and protocol claims, distributed-claim tokens, lossy numeric
    decoding, and non-ASCII or oversized subjects; preserve private JSON numbers
    without float64 coercion.

  • Preserve fractional temporal boundaries, validate every claim before nonce
    consumption, keep nonce cancellation unavailable, and prevent a canceled
    refresh owner from poisoning other callers.

  • Enforce exact token issuers, trusted additional audiences, duplicate-audience
    rejection, provider-advertised algorithms, strict metadata, and fail-closed
    JWKS expiry during provider outages.

  • Bound and synchronize discovery plus metadata/JWKS refresh, eagerly initialize
    keys, probe unknown key IDs after a cooldown, spread refresh with per-instance
    jitter, and redact provider failures.

  • Enforce hard configuration ceilings and algorithm-specific public-key shape
    and size bounds before accepting provider keys.

  • Support caller-owned nonce replay checks with panic containment and optional
    at_hash and c_hash validation through ValidateIDToken.

Added

  • Add the stable OpenID Connect, JOSE, JSON, HTTP, cache, rotation, lifecycle,
    and diagnostic specification decision register with executable evidence.

  • Add specification, public-option, failure, lifecycle, fleet-refresh, fuzz,
    interoperability, and benchmark hardening evidence, including a pinned Google
    discovery snapshot and an ephemeral provider-issued token from an immutable
    Keycloak 26.3.2 image.

  • Add TrustedAudiences, TokenBinding, and ValidateIDToken for explicit
    multi-audience and front-channel token-binding policy.

  • Document supported profiles, exclusions, setup, adoption, cache rotation,
    concurrency, cancellation, resource lifetime, security, migration, and FAQ.

Distribution

  • Include the canonical MIT licence in the independently published module.

Compatibility

  • Added a pinned module export baseline so incompatible public API changes
    fail the canonical repository gate.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-authentication/oidc identity while preserving its documented API and behavior.

  • Refresh local v0.0.0 owned-module checksums after dependency manifests and
    release notes were normalized; runtime behavior and public APIs are
    unchanged.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Refreshed the canonical authentication checksum after its test archive
    changed, preserving isolated module verification.

  • Refreshed the canonical authentication checksum after its API compatibility
    baseline was normalized to the module boundary.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Loading

github.com/faustbrian/go-authentication/jwt v1.0.0

github.com/faustbrian/go-authentication/jwt v1.0.0

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:10
jwt/v1.0.0
9f3aa6f

1.0.0 - 2026-08-25

Security

  • Use one clock instant for every claim check in a validation attempt, reject
    fractional and exponent NumericDate encodings that invite parser-dependent
    rounding, and preserve private JSON numbers losslessly instead of exposing
    rounded float64 values.
  • Require verification-only JWK operations, treat conflicting max-age
    directives as immediately stale, and keep remote work permanently rejected
    after close begins even when a close attempt is canceled.
  • Make the default remote HTTP transport safe, reject typed-nil transports,
    and complete successful remote-cache initialization with exactly one bounded
    request.
  • Preserve the last validated remote key set across hostile refresh responses,
    prove old-key eviction and outage recovery, and ensure unknown key IDs never
    trigger attacker-driven fetches.
  • Require canonical unpadded base64url signatures and JSON-number NumericDate
    claims; add exact subject allowlists and custom required-claim policy, and
    reject configurations whose claim bound cannot hold every required claim.
  • Reject build-tag-dependent ES256K so the published algorithm matrix remains
    completely executable under the module's canonical build.
  • Keep safe standards error categories while replacing provider and transport
    causes with a stable redacted key-provider category.
  • Route automatic JWKS refresh through the configured hardened client,
    serialize it with explicit refresh work, detach provider lifetime from the
    constructor context, honor freshness directives and response age, and avoid
    body-limit arithmetic overflow.
  • Reject invalid UTF-8 in protected headers and claim sets instead of allowing
    JSON decoding to replace malformed bytes.
  • Enforce algorithm-specific HMAC sizes, RSA modulus bounds, exact EC curves,
    public-only asymmetric verification keys, and reject token-provided key
    references, unpaired Unicode surrogates, and oversized JSON numbers.
  • Bound remote JWK headers, bodies, key counts, initialization, and concurrent
    operations; reject redirects and compression; validate responses before
    caching; deep-copy returned sets; coalesce refreshes; and independently
    jitter refresh schedules across provider instances.

Documentation

  • Link the package README to the repository-wide Golib documentation portal.

  • Add the stable JWT, JOSE, JSON, remote-JWKS, cache, lifecycle, and diagnostic
    specification decision register with executable evidence links.

  • Document strict claim and algorithm policy, local and remote key ownership,
    fail-stale refresh behavior, cancellation, close semantics, error redaction,
    adoption, migration, security tradeoffs, and compatibility.

Interoperability

  • Add full signed-payload and cache-header fuzz boundaries alongside the
    compact-token and remote-response fuzz targets.
  • Add the RFC 7515 Appendix A.2 RS256 compact JWS and bidirectional
    golang-jwt interoperability for every shared HMAC, RSA, PSS, and ECDSA
    algorithm.
  • Verify bidirectional HS256 compatibility with golang-jwt v5 in addition to
    the pinned RFC 7520 JWK vector and lestrrat-go/jwx implementation.

Distribution

  • Include the canonical MIT licence in the independently published module.

Compatibility

  • Added a pinned module export baseline so incompatible public API changes
    fail the canonical repository gate.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-authentication/jwt identity while preserving its documented API and behavior.

  • Refresh local v0.0.0 owned-module checksums after dependency manifests and
    release notes were normalized; runtime behavior and public APIs are
    unchanged.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Refreshed the canonical authentication checksum after its test archive
    changed, preserving isolated module verification.

  • Refreshed the canonical authentication checksum after its API compatibility
    baseline was normalized to the module boundary.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Loading

github.com/faustbrian/go-authentication/authotel v1.0.0

github.com/faustbrian/go-authentication/authotel v1.0.0

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:10
authotel/v1.0.0
9f3aa6f

1.0.0 - 2026-08-25

Documentation

  • Link the package README to the repository-wide Golib documentation portal.

Distribution

  • Include the canonical MIT licence in the independently published module.

Compatibility

  • Added a pinned module export baseline so incompatible public API changes
    fail the canonical repository gate.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-authentication/authotel identity while preserving its documented API and behavior.

  • Refresh local v0.0.0 owned-module checksums after dependency manifests and
    release notes were normalized; runtime behavior and public APIs are
    unchanged.

  • Normalize credential, outcome, and failure dimensions to the documented
    closed value sets; clamp negative durations; complete each attempt exactly
    once under duplicate or concurrent callbacks without making duplicates wait
    for provider work; and isolate provider and observer panics without
    disclosing panic values.

  • Define adapter telemetry convention version 1.0.0 without mislabeling it as
    an OpenTelemetry instrumentation-module version or schema URL, and document
    signal stability, bounded-provider prerequisites, provider ownership,
    privacy, cancellation, concurrency, lifecycle, compatibility, and migration
    policy.

  • Preserve the caller context when a hostile tracer returns nil and release
    captured request context and span references after the winning completion so
    retained callbacks cannot retain request state.

  • Expand hardening proof across complete captured-telemetry redaction,
    high-concurrency cardinality, bounded batch-exporter backpressure, hostile
    provider fuzzing, SDK errors and shutdown, and enabled, sampled-out, no-op,
    and direct-instrumentation allocation benchmarks with enforced relative
    latency and allocation budgets.

  • Make the unavoidable bounded synchronous-provider prerequisite explicit:
    indefinitely blocking implementations are outside the supported contract
    because containing them would require unbounded abandoned goroutines.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Refreshed the canonical authentication checksum after its test archive
    changed, preserving isolated module verification.

  • Refreshed the canonical authentication checksum after its API compatibility
    baseline was normalized to the module boundary.

Added

  • Add an allocation-aware benchmark for the complete authentication
    instrumentation start-and-finish path.
  • Add bounded fuzz coverage for arbitrary credential, outcome, failure, and
    duration values across the complete instrumentation lifecycle.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Loading