Skip to content

Commit 8c53d0a

Browse files
lestrratdependabot[bot]frestr
authored
v1.2.28 (#1052)
* Update deps * remove stray v2 import * Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.2 to 1.7.5. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.7.2...v1.7.5) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy * Bump github.com/goccy/go-json from 0.9.7 to 0.9.8 (#769) * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 (#771) * bump github/goccy/go-json to 0.9.10 (#780) * Update deps (#800) * Update deps * upgrade golangci-lint run * Update develop/v1 to testify v1.8.1 * Bump github.com/goccy/go-json from 0.9.11 to 0.10.0 (#856) * Bump github.com/goccy/go-json from 0.9.11 to 0.10.0 Bumps [github.com/goccy/go-json](https://github.com/goccy/go-json) from 0.9.11 to 0.10.0. - [Release notes](https://github.com/goccy/go-json/releases) - [Changelog](https://github.com/goccy/go-json/blob/master/CHANGELOG.md) - [Commits](goccy/go-json@v0.9.11...v0.10.0) --- updated-dependencies: - dependency-name: github.com/goccy/go-json dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Update develop/v1 CI (#862) * Update CI for develop/v1 * Update smoke as well * silence warning * regenerate file * Update stale action version * See if this allows us to bypass azure only when necessary * run apt-get update as well * Update ci.yml as well * remove sed magic * Check which algorithms are available before running tests * log skipped algorithms * Bump github.com/lestrrat-go/option from 1.0.0 to 1.0.1 (#861) * Bump github.com/lestrrat-go/option from 1.0.0 to 1.0.1 Bumps [github.com/lestrrat-go/option](https://github.com/lestrrat-go/option) from 1.0.0 to 1.0.1. - [Release notes](https://github.com/lestrrat-go/option/releases) - [Commits](lestrrat-go/option@v1.0.0...v1.0.1) --- updated-dependencies: - dependency-name: github.com/lestrrat-go/option dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update Changes * Bump golang.org/x/crypto from 0.0.0-20220427172511-eb4f295cb31f to 0.6.0 (#870) * Bump golang.org/x/crypto from 0.0.0-20220427172511-eb4f295cb31f to 0.6.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.0.0-20220427172511-eb4f295cb31f to 0.6.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](https://github.com/golang/crypto/commits/v0.6.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run appropriate `go get` and `go mod tidy` all over --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (#874) * Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.1 to 1.8.2. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.8.1...v1.8.2) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * run `go get` and `go mod tidy` all over --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump golang.org/x/crypto from 0.6.0 to 0.7.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](golang/crypto@v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy * Bump github.com/goccy/go-json from 0.10.0 to 0.10.1 (#883) * Bump github.com/goccy/go-json from 0.10.0 to 0.10.1 Bumps [github.com/goccy/go-json](https://github.com/goccy/go-json) from 0.10.0 to 0.10.1. - [Release notes](https://github.com/goccy/go-json/releases) - [Changelog](https://github.com/goccy/go-json/blob/master/CHANGELOG.md) - [Commits](goccy/go-json@v0.10.0...v0.10.1) --- updated-dependencies: - dependency-name: github.com/goccy/go-json dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump github.com/goccy/go-json from 0.10.1 to 0.10.2 (#891) * Bump github.com/goccy/go-json from 0.10.1 to 0.10.2 Bumps [github.com/goccy/go-json](https://github.com/goccy/go-json) from 0.10.1 to 0.10.2. - [Release notes](https://github.com/goccy/go-json/releases) - [Changelog](https://github.com/goccy/go-json/blob/master/CHANGELOG.md) - [Commits](goccy/go-json@v0.10.1...v0.10.2) --- updated-dependencies: - dependency-name: github.com/goccy/go-json dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump golang.org/x/crypto from 0.7.0 to 0.8.0 (#898) * Bump golang.org/x/crypto from 0.7.0 to 0.8.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.7.0 to 0.8.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](golang/crypto@v0.7.0...v0.8.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump actions/checkout from 2 to 3 (#900) Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v2...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump kentaro-m/auto-assign-action from 1.2.0 to 1.2.5 (#901) Bumps [kentaro-m/auto-assign-action](https://github.com/kentaro-m/auto-assign-action) from 1.2.0 to 1.2.5. - [Release notes](https://github.com/kentaro-m/auto-assign-action/releases) - [Commits](kentaro-m/auto-assign-action@v1.2.0...v1.2.5) --- updated-dependencies: - dependency-name: kentaro-m/auto-assign-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/cache from 2 to 3 (#902) Bumps [actions/cache](https://github.com/actions/cache) from 2 to 3. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v2...v3) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/setup-go from 2 to 4 (#903) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 2 to 4. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v2...v4) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/stale from 7 to 8 (#904) Bumps [actions/stale](https://github.com/actions/stale) from 7 to 8. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v7...v8) --- updated-dependencies: - dependency-name: actions/stale dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.1.0 to 4.2.0 (#906) * Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.1.0 to 4.2.0 Bumps [github.com/decred/dcrd/dcrec/secp256k1/v4](https://github.com/decred/dcrd) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/decred/dcrd/releases) - [Changelog](https://github.com/decred/dcrd/blob/master/CHANGES) - [Commits](decred/dcrd@blockchain/v4.1.0...dcrec/secp256k1/v4.2.0) --- updated-dependencies: - dependency-name: github.com/decred/dcrd/dcrec/secp256k1/v4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump golang.org/x/crypto from 0.8.0 to 0.9.0 (#920) * Bump golang.org/x/crypto from 0.8.0 to 0.9.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.8.0 to 0.9.0. - [Commits](golang/crypto@v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (#926) * Bump github.com/stretchr/testify from 1.8.2 to 1.8.3 Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.2 to 1.8.3. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.8.2...v1.8.3) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (#930) * Bump github.com/stretchr/testify from 1.8.3 to 1.8.4 Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.3 to 1.8.4. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.8.3...v1.8.4) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * port extract padding fix from 3275e21 (#934) * Update Changes * Bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#937) * Bump golang.org/x/crypto from 0.9.0 to 0.10.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.9.0 to 0.10.0. - [Commits](golang/crypto@v0.9.0...v0.10.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Accept a single KeyOperation in key.Set() (#946) * Bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#955) * Bump golang.org/x/crypto from 0.10.0 to 0.11.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.10.0 to 0.11.0. - [Commits](golang/crypto@v0.10.0...v0.11.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#962) * Bump golang.org/x/crypto from 0.11.0 to 0.12.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.11.0 to 0.12.0. - [Commits](golang/crypto@v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump actions/checkout from 3 to 4 (#973) Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/crypto from 0.12.0 to 0.13.0 (#975) * Bump golang.org/x/crypto from 0.12.0 to 0.13.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.12.0 to 0.13.0. - [Commits](golang/crypto@v0.12.0...v0.13.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy * remove accidentally included jwx/v2 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Update golangci-lint to 1.54.2 (#988) * Bump github.com/lestrrat-go/blackmagic from 1.0.1 to 1.0.2 (#984) * Bump github.com/lestrrat-go/blackmagic from 1.0.1 to 1.0.2 Bumps [github.com/lestrrat-go/blackmagic](https://github.com/lestrrat-go/blackmagic) from 1.0.1 to 1.0.2. - [Commits](lestrrat-go/blackmagic@v1.0.1...v1.0.2) --- updated-dependencies: - dependency-name: github.com/lestrrat-go/blackmagic dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump golang.org/x/crypto from 0.13.0 to 0.14.0 (#992) * Bump golang.org/x/crypto from 0.13.0 to 0.14.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.13.0 to 0.14.0. - [Commits](golang/crypto@v0.13.0...v0.14.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Bump golang.org/x/crypto from 0.14.0 to 0.15.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.15.0. - [Commits](golang/crypto@v0.14.0...v0.15.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy * Bump golang.org/x/crypto from 0.15.0 to 0.16.0 (#1021) * Bump golang.org/x/crypto from 0.15.0 to 0.16.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.16.0. - [Commits](golang/crypto@v0.15.0...v0.16.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run make tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Fix p2c (#1025) * Fix p2c handling * Update Changes * Update Changes * Bump actions/setup-go from 4 to 5 (#1028) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/stale from 8 to 9 (#1030) Bumps [actions/stale](https://github.com/actions/stale) from 8 to 9. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v8...v9) --- updated-dependencies: - dependency-name: actions/stale dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/crypto from 0.16.0 to 0.17.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.16.0 to 0.17.0. - [Commits](golang/crypto@v0.16.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run make tidy * Merge pull request from GHSA-pvcr-v8j8-j5q3 * Apply (almost) the same changes as in 5c74fb787e5bd6a29818629b24d92d4cc753301e...42d749aaef80d30e2817c6b5a998e714e7caf27a * JWS: Check for sig.protected == nil on non-flattened input (cherry picked from commit bd3148e2d345465a51bcf8a96cb411f14b73f1c1) * JWS: Check that unmarshalled signature is present before decoding --------- Co-authored-by: Fredrik Strupe <fredrik@strupe.net> * Update Changes * Fix typo --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Fredrik Strupe <fredrik@strupe.net>
1 parent 611567b commit 8c53d0a

File tree

12 files changed

+93
-17
lines changed

12 files changed

+93
-17
lines changed

Diff for: .github/workflows/benchmark.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
restore-keys: |
2525
${{ runner.os }}-go-
2626
- name: Install Go stable version
27-
uses: actions/setup-go@v4
27+
uses: actions/setup-go@v5
2828
with:
2929
go-version: ${{ matrix.go }}
3030
- name: Install benchstat

Diff for: .github/workflows/ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
run: curl --connect-timeout 1 https://azure.archive.ubuntu.com || (sudo sed -i 's/azure\.//' /etc/apt/sources.list && sudo apt-get update)
3030
- name: Install Go stable version
3131
if: matrix.go != 'tip'
32-
uses: actions/setup-go@v4
32+
uses: actions/setup-go@v5
3333
with:
3434
go-version: ${{ matrix.go }}
3535
- name: Install Go tip

Diff for: .github/workflows/lint.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
runs-on: ubuntu-latest
77
steps:
88
- uses: actions/checkout@v4
9-
- uses: actions/setup-go@v4
9+
- uses: actions/setup-go@v5
1010
with:
1111
go-version: 1.19
1212
check-latest: true

Diff for: .github/workflows/smoke.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
- name: Munge APT Repositories
3232
run: curl --connect-timeout 1 https://azure.archive.ubuntu.com || (sudo sed -i 's/azure\.//' /etc/apt/sources.list && sudo apt-get update)
3333
- name: Install Go stable version
34-
uses: actions/setup-go@v4
34+
uses: actions/setup-go@v5
3535
with:
3636
go-version: ${{ matrix.go }}
3737
- name: Install stringer

Diff for: .github/workflows/stale.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ jobs:
77
stale:
88
runs-on: ubuntu-latest
99
steps:
10-
- uses: actions/stale@v8
10+
- uses: actions/stale@v9
1111
with:
1212
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
1313
stale-pr-message: 'This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.'

Diff for: Changes

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
11
Changes
22
=======
33

4+
v1.2.28 09 Jan 2024
5+
[Security Fixes]
6+
* [jws] JWS messages formated in full JSON format (i.e. not the compact format, which
7+
consists of three base64 strings concatenated with a '.') with missing "protected"
8+
headers could cause a panic, thereby introducing a possiblity of a DoS.
9+
10+
This has been fixed so that the `jws.Parse` function succeeds in parsing a JWS message
11+
lacking a protected header. Calling `jws.Verify` on this same JWS message will result
12+
in a failed verification attempt. Note that this behavior will differ slightly when
13+
parsing JWS messages in compact form, which result in an error.
14+
415
v1.2.27 - 03 Dec 2023
516
[Security]
617
* [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
@@ -247,7 +258,7 @@ v1.2.6 24 Aug 2021
247258
* Support `crypto.Signer` keys for RSA, ECDSA, and EdDSA family
248259
of signatures in `jws.Sign`
249260
[Miscellaneous]
250-
* `jwx.GuessFormat()` now requires the presense of both `payload` and
261+
* `jwx.GuessFormat()` now requires the presence of both `payload` and
251262
`signatures` keys for it to guess that a JSON object is a JWS message.
252263
* Slightly enhance `jwt.Parse()` performance.
253264

Diff for: bench/performance/go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
3232
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
3333
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
3434
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
35-
golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
36-
golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
35+
golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
36+
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
3737
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
3838
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
3939
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

Diff for: examples/go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
3535
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
3636
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
3737
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
38-
golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
39-
golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
38+
golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
39+
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
4040
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
4141
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
4242
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

Diff for: go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ require (
1212
github.com/lestrrat-go/option v1.0.1
1313
github.com/pkg/errors v0.9.1
1414
github.com/stretchr/testify v1.8.4
15-
golang.org/x/crypto v0.16.0
15+
golang.org/x/crypto v0.17.0
1616
)
1717

1818
retract v1.2.16 // Packaging problems.

Diff for: go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
3232
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
3333
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
3434
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
35-
golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
36-
golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
35+
golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
36+
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
3737
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
3838
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
3939
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

Diff for: jws/jws_test.go

+53
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"github.com/lestrrat-go/jwx/jwk"
3333
"github.com/lestrrat-go/jwx/jws"
3434
"github.com/stretchr/testify/assert"
35+
"github.com/stretchr/testify/require"
3536
)
3637

3738
const examplePayload = `{"iss":"joe",` + "\r\n" + ` "exp":1300819380,` + "\r\n" + ` "http://example.com/is_root":true}`
@@ -1795,3 +1796,55 @@ func TestGH681(t *testing.T) {
17951796
return
17961797
}
17971798
}
1799+
1800+
func TestEmptyProtectedField(t *testing.T) {
1801+
// MEMO: this was the only test case from the original report
1802+
// This passes. It should produce an invalid JWS message, but
1803+
// that's not `jws.Parse`'s problem.
1804+
_, err := jws.Parse([]byte(`{"signature": ""}`))
1805+
require.NoError(t, err, `jws.Parse should fail`)
1806+
1807+
// Also test that non-flattened serialization passes.
1808+
_, err = jws.Parse([]byte(`{"signatures": [{}]}`))
1809+
require.NoError(t, err, `jws.Parse should fail`)
1810+
1811+
// MEMO: rest of the cases are present to be extra pedantic about it
1812+
1813+
privKey, err := jwxtest.GenerateRsaJwk()
1814+
require.NoError(t, err, `jwxtest.GenerateRsaJwk should succeed`)
1815+
1816+
// This fails. `jws.Parse` works, but the subsequent verification
1817+
// workflow fails to verify anything without the presence of a signature or
1818+
// a protected header.
1819+
_, err = jws.Verify([]byte(`{"signature": ""}`), jwa.RS256, privKey)
1820+
require.Error(t, err, `jws.Parse should fail`)
1821+
1822+
// Create a valid signatre.
1823+
signed, err := jws.Sign([]byte("Lorem Ipsum"), jwa.RS256, privKey)
1824+
require.NoError(t, err, `jws.Sign should succeed`)
1825+
1826+
_, payload, signature, err := jws.SplitCompact(signed)
1827+
require.NoError(t, err, `jws.SplitCompact should succeed`)
1828+
1829+
// This fails as well. we have a valid signature and a valid
1830+
// key to verify it, but no protected headers
1831+
_, err = jws.Verify(
1832+
[]byte(fmt.Sprintf(`{"signature": "%s"}`, signature)),
1833+
jwa.RS256, privKey,
1834+
)
1835+
require.Error(t, err, `jws.Verify should fail`)
1836+
1837+
// Test for cases when we have an incomplete compact form JWS
1838+
var buf bytes.Buffer
1839+
buf.WriteRune('.')
1840+
buf.Write(payload)
1841+
buf.WriteRune('.')
1842+
buf.Write(signature)
1843+
invalidMessage := buf.Bytes()
1844+
1845+
// This is an error because the format is simply wrong.
1846+
// Whereas in the other JSON-based JWS's case the lack of protected field
1847+
// is not a SYNTAX error, this one is, and therefore we barf.
1848+
_, err = jws.Parse(invalidMessage)
1849+
require.Error(t, err, `jws.Parse should fail`)
1850+
}

Diff for: jws/message.go

+16-4
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,13 @@ func (s *Signature) UnmarshalJSON(data []byte) error {
9191
s.protected = prt
9292
}
9393

94-
decoded, err := base64.DecodeString(*sup.Signature)
95-
if err != nil {
96-
return errors.Wrap(err, `failed to base decode signature`)
94+
if sup.Signature != nil {
95+
decoded, err := base64.DecodeString(*sup.Signature)
96+
if err != nil {
97+
return errors.Wrap(err, `failed to base decode signature`)
98+
}
99+
s.signature = decoded
97100
}
98-
s.signature = decoded
99101
return nil
100102
}
101103

@@ -282,6 +284,11 @@ func (m *Message) UnmarshalJSON(buf []byte) error {
282284
}
283285
sig.SetDecodeCtx(nil)
284286

287+
if sig.protected == nil {
288+
// Instead of barfing on a nil protected header, use an empty header
289+
sig.protected = NewHeaders()
290+
}
291+
285292
if i == 0 {
286293
if !getB64Value(sig.protected) {
287294
b64 = false
@@ -317,6 +324,11 @@ func (m *Message) UnmarshalJSON(buf []byte) error {
317324
sig.protected = prt
318325
}
319326

327+
if sig.protected == nil {
328+
// Instead of barfing on a nil protected header, use an empty header
329+
sig.protected = NewHeaders()
330+
}
331+
320332
decoded, err := base64.DecodeString(*mup.Signature)
321333
if err != nil {
322334
return errors.Wrap(err, `failed to base64 decode flattened signature`)

0 commit comments

Comments
 (0)