Skip to content

v0.1.1

Choose a tag to compare

View all tags
@ScottHelme ScottHelme released this 16 May 12:29
v0.1.1
7731070
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Test-only maintenance release. Supersedes v0.1.0 — recommended over v0.1.0.

No library changes: src/ is byte-identical to v0.1.0. This release only makes the bundled test harness deterministic.

Fixed

  • _test/run-tests.php: the fake device built its JWK EC coordinates straight from openssl_pkey_get_details(), which strips leading zero bytes, so ~1/256 generated keys produced a <32-byte x/y and the (correct, RFC 7518-compliant) verifier rejected them — an intermittent test failure. The fake device now left-pads coordinates to the fixed 32-byte width, exactly as a spec-compliant client (and real Chrome) does. Verified deterministic over 300 consecutive runs and CI on PHP 8.1–8.4. (#3)

Note

The strict fixed-width JWK check in JwtVerifier is intentional and unchanged — it correctly rejects non-spec-compliant keys.

Still 0.x — the packaging API (RequestContext / DbscResponse / StoreInterface) may change before v1.0.0; see the README.

Assets 2
Loading