Add scitokens-generate-jwks CLI for key generation #186

Copilot · 2025-12-09T12:20:56Z

Implementation Complete: JWKS Creation CLI ✅

This PR adds a new CLI tool scitokens-generate-jwks that generates EC (ES256) key pairs and exports them in JWKS and PEM formats, eliminating the need for Python libraries in integration tests.

Features

✅ Generates EC P-256 key pairs using OpenSSL
✅ Exports public key in JWKS format (JSON)
✅ Exports public and private keys in PEM format
✅ Supports custom key IDs and output file paths
✅ Auto-generates unique key ID from public key fingerprint (SHA256 hash, first 8 hex chars) when not specified
✅ Secures private key with file permissions 0600 (owner read/write only)
✅ Compatible with OpenSSL 1.x and 3.x
✅ Proper RAII patterns for memory safety

Changes

New file: src/generate_jwks.cpp (365 lines)
Updated: CMakeLists.txt - added build target
Updated: README.md - added usage documentation
Updated: .gitignore - excluded build artifacts

Code Quality

All code review feedback addressed:

✅ RAII with std::unique_ptr throughout
✅ Proper ownership transfer without leaks
✅ Simplified pointer management
✅ const correctness
✅ Automatic resource cleanup
✅ clang-format linter compliance
✅ Unique key ID generation from fingerprint
✅ Secure file permissions for private keys

Testing

✅ Key generation tested on OpenSSL 3.x
✅ JWKS output validated as valid JSON
✅ Integration tested with scitokens-create & scitokens-verify
✅ CodeQL security scan: 0 issues
✅ clang-format linting: passing
✅ Auto-generated key IDs verified unique per key
✅ Private key permissions verified as 0600

Usage Example

# Generate with auto-generated key ID from fingerprint
./scitokens-generate-jwks

# Generate with custom key ID
./scitokens-generate-jwks --kid my-key

# Use with existing tools
./scitokens-create --cred public.pem --key private.pem --keyid <kid> --issuer https://issuer.example.com

Ready for merge - All requirements met, code review feedback addressed, tests passing.

Original prompt

This section details on the original issue you should resolve

<issue_title>Add JWKS creation CLI</issue_title>
<issue_description>When creating the integration test, the only option for creating the JWKS file was pulling in some Python libraries.

We have code already for creating keys. Let's add a simple CLI utility, usable by the tests, for creating a JWKS.</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Add JWKS creation CLI #185

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

…tring literal cast Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

…management Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

…ream Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

bbockelm · 2025-12-09T12:49:34Z

@copilot - please fix the linter issues.

bbockelm

@copilot - please address code review items.

bbockelm · 2025-12-09T12:35:20Z

src/generate_jwks.cpp

+
+const char short_options[] = "hk:j:p:P:";
+
+std::string g_kid = "key-es256";


If not specified, generate the keyid by taking a fingerprint of the public key, converting it to hex, and taking the first 8 characters. This makes the generated key ID more unique.

Implemented in commit dbe9088. The key ID is now auto-generated from the SHA256 fingerprint of the public key (first 8 hex characters) when not specified via --kid option.

bbockelm · 2025-12-09T12:36:42Z

src/generate_jwks.cpp

+    // Write private key PEM
+    std::unique_ptr<BIO, decltype(&BIO_free_all)> priv_bio(BIO_new_file(
+                                                                g_private_file.c_str(), "w"),
+                                                            BIO_free_all);


The private key needs special code to ensure it is written with mode 0600 so others cannot read it

Fixed in commit dbe9088. Private key file is now created with mode 0600 using open() with O_CREAT before writing, ensuring only the owner can read/write the file.

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Copilot · 2025-12-09T12:53:28Z

@copilot - please fix the linter issues.

Fixed in commit 5c351b3. Applied clang-format to resolve all formatting issues.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

esm.ubuntu.com
- Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

… key permissions - Auto-generate key ID from SHA256 hash of public key (first 8 hex chars) if not specified - Set private key file permissions to 0600 for security - Update usage text to reflect auto-generated key ID default Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Copilot · 2025-12-09T13:01:14Z

@copilot - please address code review items.

All code review items addressed in commit dbe9088:

Auto-generate unique key ID from public key fingerprint (SHA256, first 8 hex chars)
Set private key file permissions to 0600 for security

bbockelm

LGTM

Initial plan

09e815c

Copilot AI assigned Copilot and bbockelm Dec 9, 2025

Copilot started work on behalf of bbockelm December 9, 2025 12:21 View session

Copilot AI and others added 8 commits December 9, 2025 12:29

Add scitokens-generate-jwks CLI tool for key generation

fed0944

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Fix memory management in generate_jwks.cpp to use RAII

15ac0bf

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Add documentation for scitokens-generate-jwks tool

dac5028

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Update .gitignore to exclude CodeQL build artifacts

e94b228

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Address code review comments: remove unnecessary null check and fix s…

ebdd62f

…tring literal cast Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Complete RAII refactoring for all memory management paths

dbdb1b9

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Final RAII improvements: fix ownership transfer and simplify pointer …

454d419

…management Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Code polish: use const char* for curve_name and rely on RAII for ofst…

0792a87

…ream Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add CLI utility for creating JWKS file~~ Add scitokens-generate-jwks CLI for key generation Dec 9, 2025

Copilot AI requested a review from bbockelm December 9, 2025 12:45

Copilot finished work on behalf of bbockelm December 9, 2025 12:45

Copilot started work on behalf of bbockelm December 9, 2025 12:50 View session

bbockelm requested changes Dec 9, 2025

View reviewed changes

Fix clang-format linter issues in generate_jwks.cpp

5c351b3

Co-authored-by: bbockelm <1093447+bbockelm@users.noreply.github.com>

Copilot finished work on behalf of bbockelm December 9, 2025 12:54

Copilot AI requested a review from bbockelm December 9, 2025 12:54

Copilot started work on behalf of bbockelm December 9, 2025 12:55 View session

Copilot finished work on behalf of bbockelm December 9, 2025 13:03

bbockelm approved these changes Dec 9, 2025

View reviewed changes

bbockelm marked this pull request as ready for review December 9, 2025 13:35

bbockelm merged commit 7557e71 into master Dec 9, 2025
21 of 22 checks passed

Copilot AI added a commit that referenced this pull request Dec 9, 2025

Add scitokens-generate-jwks CLI for key generation (#186)

3f94bdc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add scitokens-generate-jwks CLI for key generation #186

Add scitokens-generate-jwks CLI for key generation #186

Uh oh!

Copilot AI commented Dec 9, 2025 •

edited

Loading

Uh oh!

bbockelm commented Dec 9, 2025

Uh oh!

bbockelm left a comment

Uh oh!

bbockelm Dec 9, 2025

Uh oh!

Copilot AI Dec 9, 2025

Uh oh!

bbockelm Dec 9, 2025

Uh oh!

Copilot AI Dec 9, 2025

Uh oh!

Copilot AI commented Dec 9, 2025 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI commented Dec 9, 2025

Uh oh!

bbockelm left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		const char short_options[] = "hk:j:p:P:";

		std::string g_kid = "key-es256";

Add scitokens-generate-jwks CLI for key generation #186

Add scitokens-generate-jwks CLI for key generation #186

Uh oh!

Conversation

Copilot AI commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Complete: JWKS Creation CLI ✅

Features

Changes

Code Quality

Testing

Usage Example

Comments on the Issue (you are @copilot in this section)

Uh oh!

bbockelm commented Dec 9, 2025

Uh oh!

bbockelm left a comment

Choose a reason for hiding this comment

Uh oh!

bbockelm Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

bbockelm Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI commented Dec 9, 2025

Uh oh!

bbockelm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Dec 9, 2025 •

edited

Loading

Copilot AI commented Dec 9, 2025 •

edited

Loading