V5 (#107)

* Move away from BoringSSL (#99) * Start moving away from BoringSSL * Start converting RSA * Update RSA signer * Some fixes * Add possible RSA pubkey creation algorithm * Add prime number generator with Miller-Rabin test * Prime generation performance improvement * Attempt at private key calculation * RSA prime generation take 2 * API tidy up * Performance improvements * Even more speed * RSA tidy up * Fix JWTSigner with new RSA impl * Add RSA tests and polish some stuff * Remove unused method * Minor improvements * Add GCD test * Get ECDSA compiling * Add key gen test + fixups * Add RSA cert support + enforce bigger key sizes * Start adding ECDSA tests * Generify ECDSAKey * Abstract more and add P384 and P521 keys * Adapt curve sizes * Fix some tests * Base64URL decode raw key elements * Update byteRange names * Remove BoringSSL * Update error description * Fix wrong overload resolution * Add padding option for RSA signer * Update platform versions and start converting X5C * Convert X5CVerifier and X5CTests (SHA256) * Add certificate creation scripts * Fix comment * Address most requested issues * Add docs and replace struct with tuple * Remove valid X5C print statement * Remove `rsa_oaep_misc_test` test vectors * Performance improvements * Remove unused files * Apply suggestions * 🤦‍♂️ * Minor fixes * Refactor RSA init * Make RSAKey a struct and update docs * Implement `JWTKeyCollection` and hide `JWTSigner` (#111) * Implement `JWTKeyCollection` and hide `JWTSigner` * Make `JWTSigner` `Sendable` * Add comments and remove unused method * Add warning when overwriting kid * Remove `JWTSigners` * Make `JWKSigner` `Sendable` * Cleanups * Update DocC comments * Minor improvements * Add RSA pre-generated token test (#114) Add RS256 pre-generated token test * Enable full CI on the 5.x branch * Skip API breakage check for 5.x branch for now * Add `Sendable` support (#116) * Add `Sendable` support * Add Sendable conformance to tests * Make X5CVerifier a struct --------- Co-authored-by: Gwynne Raskind <gwynne@vapor.codes> * Rename ES521 to ES512 * Rename signer to algorithm * Add support for custom time validation X5Cs (#119) * Add support for custom time validation X5Cs * Clean up and move JSONDecoder settings out of X5C * Add more assertions in new X5C test * Refactor X5CTests * Add ECDSAKey PEM export (#120) * Add ECDSAKey PEM export * Use public key from private when possible * Refactor ECDSAKey init * Remove exports (#121) Start removing exports * Adopt `package` access and add RSA key PEM export (#122) * Adopt `package` access and add RSA key PEM export * Remove unused code * Make equatable conformance public * Optimise RSAKey Equatable implementation * Refactor RSAKey Equatable implementation * Remove public enums (#123) * Start removing enums * Update JWTError * Add custom decoding for new structs * Adopt a more structured JWTError * Minor improvements * Test integration with v5 of JWT * Make JWK use existing curves * Nit: spacing --------- Co-authored-by: Gwynne Raskind <gwynne@vapor.codes> * Remove use of `Data(contentsOf:)` * Add RSA-PSS signature algorithm support (#112) * Add RSA-PSS signature algorithm support * Add PSS signers and tests * Replace `Data(contentsOf:)` with `URLSession` * Remove Apple jwks test * Fix keycollection's getSigner method * Fix keycollection's getSigner method --------- Co-authored-by: Paul <paultoffoloni@gmail.com> * Adjust JWTError access modifiers * Adjust JWTError access modifiers once again * Add option to sign tokens with x5c chains (#126) * Add option to sign tokens with x5c chains * Add new test and fixes * Add option to fetch RSA primitives (#127) * Add option to fetch RSA primitives * Typo * Remove unused files * Update NOTICES * Split internal key structure into public and private (#128) * Create first idea of split RSA keys * Refactor signer and update docs * Split ECDSA keys * Remove useless parameter * Update EdDSA * Rename file * Adjust spacing * Remove useless implementations * Clean up some access modifiers * Move RSA to insecure namespace * Add customisable fields to JWTHeader (#129) * Add customisable fields to JWTHeader * Remove unused field * Fix en/decoding logic and add remove `package` use * Make customFields not optional * Add correct init to JWTHeader * Fix CodingKey mismatch * Remove `CaseIterable` conformance * Fix * Add `float` jwt header field type * Allow for custom JWT de/serialisation (#130) * Improve header structure * Allow for custom JWT de/serialisation * Make properties return nil instead of throwing * Make the new API easier to use * Add platform-agnostic de/compression algorithms * Remove unnecessary test * Update swift-certificates and add customisable policy to X5C verification * Add key initialiser for SwiftCrypto key types * Add `missingX5CHeader` error * Add RSA size boundary (#135) Add 2048 bits key size boundary for RSA keys * Update README and DocC (#136) * Start updating README * Update badges in README * Update CODEOWNERS * Update README.md Co-authored-by: Gwynne Raskind <gwynne@vapor.codes> * Update DocC * Update docs * Un-fancy JSON... * Revert README header upgrade * Add custom parsing/serialising comments --------- Co-authored-by: Gwynne Raskind <gwynne@vapor.codes> * Add some tests to get coverage up (#139) Add some test to get coverage up * Merge branch 'main' into 'jwtkit-5' --------- Co-authored-by: Gwynne Raskind <gwynne@vapor.codes> Co-authored-by: Matteo Franceschi <matteo.franceschi@flowpay.it>
vapor · Feb 21, 2024 · 12391f9 · 12391f9
1 parent e05513b
commit 12391f9
Show file tree

Hide file tree

Showing 692 changed files with 7,486 additions and 397,847 deletions.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -1 +1,8 @@
-*  @0xTim @gwynne
+*                            @ptoffy 
+/.github/CONTRIBUTING.md     @ptoffy @0xTim @gwynne
+/.github/workflows/*.yml     @ptoffy @0xTim @gwynne
+/.github/workflows/test.yml  @ptoffy @gwynne
+/.spi.yml                    @ptoffy @0xTim @gwynne
+/.gitignore                  @ptoffy @0xTim @gwynne
+/LICENSE                     @ptoffy @0xTim @gwynne
+/README.md                   @ptoffy @0xTim @gwynne
diff --git a/.github/contributing.md b/.github/contributing.md
diff --git a/.github/workflows/api-docs.yml b/.github/workflows/api-docs.yml
@@ -11,4 +11,4 @@ jobs:
      with:
        package_name: jwt-kit
        modules: JWTKit
-       pathsToInvalidate: /jwt-kit/*
+       pathsToInvalidate: /jwtkit/*
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -4,7 +4,7 @@ concurrency:
   cancel-in-progress: true
 on:
   pull_request: { types: [opened, reopened, synchronize, ready_for_review] }
-  push: { branches: [ main ] }
+  push: { branches: [ main, jwtkit-5 ] }
 
 jobs:
   linux-integration:
@@ -21,10 +21,13 @@ jobs:
         with:
           repository: vapor/jwt
           path: jwt
+          ref: v5
       - name: Use local JWTKit
         run: swift package --package-path jwt edit jwt-kit --path ./jwt-kit
       - name: Run tests with Thread Sanitizer
         run: swift test --package-path jwt --sanitize=thread
 
   unit-tests:
      uses: vapor/ci/.github/workflows/run-unit-tests.yml@main
+     with:
+       with_public_api_check: ${{ github.event_name == 'pull_request' && !contains(github.base_ref, 'jwtkit-5') }}
diff --git a/NOTICES.txt b/NOTICES.txt
@@ -11,10 +11,23 @@
 //
 //===----------------------------------------------------------------------===//
 
-This product contains a derivation of the Vendor BoringSSL and Build ASM scripts
-from Swift Crypto.
+This product contains a derivation of the Wycheproof tests from the Swift Crypto package.
 
   * LICENSE (Apache License 2.0):
     * https://www.apache.org/licenses/LICENSE-2.0
   * HOMEPAGE:
     * https://github.com/apple/swift-crypto
+
+This product contains the SubjectPublicKeyInfo.swift file from the Swift ASN1 package.
+
+  * LICENSE (Apache License 2.0):
+    * https://www.apache.org/licenses/LICENSE-2.0
+  * HOMEPAGE:
+    * https://github.com/apple/swift-asn1
+
+This product contains the NIOCompression and NIOCompression namespaces from the SwiftNIO Extras package.
+
+  * LICENSE (Apache License 2.0):
+    * https://www.apache.org/licenses/LICENSE-2.0
+  * HOMEPAGE:
+    * https://github.com/apple/swift-nio-extras
diff --git a/Package.swift b/Package.swift
@@ -1,41 +1,48 @@
-// swift-tools-version:5.6
+// swift-tools-version:5.9
 import PackageDescription
 
-// This package contains a vendored copy of BoringSSL. For ease of tracking
-// down problems with the copy of BoringSSL in use, we include a copy of the
-// commit hash of the revision of BoringSSL included in the given release.
-// This is also reproduced in a file called hash.txt in the
-// Sources/CCryptoBoringSSL directory. The source repository is at
-// https://boringssl.googlesource.com/boringssl.
-//
-// BoringSSL Commit: 58a318edc892a595a5b043359a5d441869158699
-
 let package = Package(
     name: "jwt-kit",
     platforms: [
-        .macOS(.v10_15),
-        .iOS(.v13),
-        .tvOS(.v13),
-        .watchOS(.v6),
+        .macOS(.v13),
+        .iOS(.v16),
+        .tvOS(.v16),
+        .watchOS(.v9),
     ],
     products: [
         .library(name: "JWTKit", targets: ["JWTKit"]),
-        /* This target is used only for symbol mangling. It's added and removed automatically because it emits build warnings. MANGLE_START
-        .library(name: "CJWTKitBoringSSL", type: .static, targets: ["CJWTKitBoringSSL"]),
-        MANGLE_END */
     ],
     dependencies: [
-        .package(url: "https://github.com/apple/swift-crypto.git", "2.0.0" ..< "4.0.0"),
+        .package(url: "https://github.com/apple/swift-crypto.git", from: "3.0.0"),
+        .package(url: "https://github.com/apple/swift-certificates.git", from: "1.2.0"),
+        .package(url: "https://github.com/attaswift/BigInt.git", from: "5.3.0"),
     ],
     targets: [
-        .target(name: "CJWTKitBoringSSL"),
-        .target(name: "JWTKit", dependencies: [
-            .target(name: "CJWTKitBoringSSL"),
-            .product(name: "Crypto", package: "swift-crypto"),
-        ]),
-        .testTarget(name: "JWTKitTests", dependencies: [
-            .target(name: "JWTKit"),
-        ]),
-    ],
-    cxxLanguageStandard: .cxx11
+        .target(
+            name: "JWTKit",
+            dependencies: [
+                .product(name: "Crypto", package: "swift-crypto"),
+                .product(name: "_CryptoExtras", package: "swift-crypto"),
+                .product(name: "X509", package: "swift-certificates"),
+                .product(name: "BigInt", package: "BigInt"),
+            ],
+            swiftSettings: [
+                .enableExperimentalFeature("StrictConcurrency"),
+            ]
+        ),
+        .testTarget(
+            name: "JWTKitTests",
+            dependencies: [
+                "JWTKit",
+            ],
+            resources: [
+                .copy("TestVectors"),
+                .copy("TestCertificates"),
+            ],
+            swiftSettings: [
+                .enableExperimentalFeature("StrictConcurrency"),
+                .enableUpcomingFeature("ConciseMagicFile"),
+            ]
+        ),
+    ]
 )