bullion 0.11.0 → 0.11.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95d9b8437f39397499aaa73d1b9abf932930ab46a29ac5f08d5ab2533b0c0b83
-  data.tar.gz: 78ca06dc463ffffd5e274bee516196d8cbaefe759b413fa5670fedc247c7c9a8
+  metadata.gz: 95ab410d446f9be5b65083d059c91636f5c4ee801b2973536387bb001623a0b2
+  data.tar.gz: 87f492721aaf01a88c746bed6e70d5709c19c7ba3192a7ae83d6c628e716a0dd
 SHA512:
-  metadata.gz: '02358422a89125d538c4eb8b5c16d875121525658c11988209cc3bd8581c4cf8a7782d37a70ae2498a3d24e4e28015320d65e2d17285e14dce9f94ea09d69063'
-  data.tar.gz: 6d927f92fdd653b044bff00f9683f57a026e1cbd504867dd89b1061cbe92219f0da11612af700d6044c90d99accb588ba19e517875547fe039173683245517e8
+  metadata.gz: 1ce61712fb1ee5ce6139bb6e105b242709c8f51eece706e116a4cff94f7361c3c7f9589598cc25373695f1df35f60b06866303f96872e1dc516748068fef338c
+  data.tar.gz: e69f33f2ee12e17572ad6ad2054a5123d7a1fe3f37471bd64432752b6b0df75892e1fba19004144349810cfae28bafb0ce23039d8cb53613f2ac9d66603eb8d1

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.11.0"
+  ".": "0.11.2"
 }

data/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## [0.11.2](https://github.com/jgnagy/bullion/compare/bullion/v0.11.1...bullion/v0.11.2) (2026-02-16)
+
+
+### Features
+
+* add EdDSA (Ed25519) JWT signature support ([bba2985](https://github.com/jgnagy/bullion/commit/bba29851e1c5644152f4a3e82d82c6c1d5c5ce5e))
+* add EdDSA (Ed25519) JWT signature support ([77a2f5b](https://github.com/jgnagy/bullion/commit/77a2f5bfc30db3527ad3fe75136b210956279957)), closes [#3](https://github.com/jgnagy/bullion/issues/3)
+* Add test coverage for Ed25519 certificate signing ([59f0f74](https://github.com/jgnagy/bullion/commit/59f0f74a039292a5d804c8e49a880f20ab5d0c1b))
+
+
+### Bug Fixes
+
+* return proper badPublicKey error for Ed448 ([a21414f](https://github.com/jgnagy/bullion/commit/a21414f66075d47e2b5613d2034fa806a0a78602))
+
+## [0.11.1](https://github.com/jgnagy/bullion/compare/bullion/v0.11.0...bullion/v0.11.1) (2025-08-24)
+
+
+### Features
+
+* add support for ECDSA CAs ([49b752e](https://github.com/jgnagy/bullion/commit/49b752ef6fde2b0543b59fb1c5977073f21b6731))
+
+
+### Bug Fixes
+
+* improve detection of SANS for cert-manager ([605f80d](https://github.com/jgnagy/bullion/commit/605f80d97135727ab9a962d6c3078b2b4a74b533))
+* loading required bigdecimal gem ([98d1668](https://github.com/jgnagy/bullion/commit/98d1668da600bba890dd0eb035af4a363fa79eef))
+
 ## [0.11.0](https://github.com/jgnagy/bullion/compare/bullion/v0.10.3...bullion/v0.11.0) (2025-08-23)
 
 

data/Gemfile.lock

@@ -1,13 +1,14 @@
 PATH
   remote: .
   specs:
-    bullion (0.11.0)
+    bullion (0.11.2)
       benchmark (~> 0.4)
       dry-configurable (~> 1.1)
       httparty (~> 0.21)
       itsi (~> 0.2)
       json (~> 2.6)
       jwt (~> 2.7)
+      jwt-eddsa (~> 0.9)
       openssl (~> 3.0)
       prometheus-client (~> 4.2)
       sinatra (~> 3.1)
@@ -46,7 +47,7 @@ GEM
     backport (1.2.0)
     base64 (0.3.0)
     benchmark (0.4.1)
-    bigdecimal (3.2.2)
+    bigdecimal (4.0.1)
     byebug (11.1.3)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.3)
@@ -61,15 +62,16 @@ GEM
       concurrent-ruby (~> 1.0)
       logger
       zeitwerk (~> 2.6)
-    faraday (2.13.4)
+    ed25519 (1.4.0)
+    faraday (2.14.1)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.1)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.4.2)
+      net-http (~> 0.5)
     faraday-retry (2.3.2)
       faraday (~> 2.0)
-    httparty (0.23.1)
+    httparty (0.24.0)
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
@@ -86,9 +88,13 @@ GEM
       rack (>= 1.6)
       rb_sys (~> 0.9.91)
     jaro_winkler (1.6.1)
-    json (2.13.2)
+    json (2.18.1)
     jwt (2.10.2)
       base64
+    jwt-eddsa (0.9.0)
+      base64
+      ed25519
+      jwt (>= 2.9.0)
     kramdown (2.5.1)
       rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
@@ -99,12 +105,12 @@ GEM
     mini_mime (1.1.5)
     minitest (5.25.5)
     multi_json (1.17.0)
-    multi_xml (0.7.2)
-      bigdecimal (~> 3.1)
+    multi_xml (0.8.1)
+      bigdecimal (>= 3.1, < 5)
     mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    net-http (0.6.0)
-      uri
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     nokogiri (1.18.9-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.18.9-aarch64-linux-musl)
@@ -132,7 +138,7 @@ GEM
     prometheus-client (4.2.5)
       base64
     racc (1.8.1)
-    rack (2.2.17)
+    rack (2.2.20)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
@@ -148,7 +154,7 @@ GEM
     regexp_parser (2.11.2)
     reverse_markdown (3.0.0)
       nokogiri
-    rexml (3.4.1)
+    rexml (3.4.2)
     rspec (3.13.1)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -245,7 +251,7 @@ GEM
     unicode-display_width (3.1.5)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
-    uri (1.0.3)
+    uri (1.1.1)
     yard (0.9.37)
     yard-solargraph (0.1.0)
       yard (~> 0.9)

data/Rakefile

@@ -62,6 +62,7 @@ end
 
 require "openssl"
 require "sqlite3"
+require "bigdecimal"
 require "trilogy"
 require "sinatra/activerecord/rake"
 

data/bullion.gemspec

@@ -32,6 +32,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "itsi",                 "~> 0.2"
   spec.add_dependency "json",                 "~> 2.6"
   spec.add_dependency "jwt",                  "~> 2.7"
+  spec.add_dependency "jwt-eddsa",            "~> 0.9"
   spec.add_dependency "openssl",              "~> 3.0"
   spec.add_dependency "prometheus-client",    "~> 4.2"
   spec.add_dependency "sinatra",              "~> 3.1"

data/lib/bullion/acme/error.rb

@@ -34,6 +34,11 @@ module Bullion
         def acme_type = "badNonce"
       end
 
+      # ACME exception for bad/unsupported public keys
+      class BadPublicKey < Bullion::Acme::Error
+        def acme_type = "badPublicKey"
+      end
+
       # ACME exception for invalid contacts in accounts
       class InvalidContact < Bullion::Acme::Error
         def acme_type = "invalidContact"

data/lib/bullion/helpers/acme.rb

@@ -41,10 +41,11 @@ module Bullion
           JWT.decode(jwt_data, compat_public_key, true, { algorithm: @header_data["alg"] })
         else
           digest = digest_from_alg(@header_data["alg"])
+          alg = @header_data["alg"].downcase
 
-          sig = if @header_data["alg"].downcase.start_with?("es")
+          sig = if alg.start_with?("es")
                   ecdsa_sig_to_der(signature)
-                elsif @header_data["alg"].downcase.start_with?("rs")
+                elsif alg.start_with?("rs") || alg == "eddsa"
                   Base64.urlsafe_decode64(signature)
                 end
 
@@ -119,13 +120,13 @@ module Bullion
         csr_attrs = extract_csr_attrs(csr)
         csr_sans = extract_csr_sans(csr_attrs)
         csr_domains = extract_csr_domains(csr_sans)
-        csr_cn = cn_from_csr(csr)
+        csr_cn = cn_from_csr(csr) || csr_domains.first
 
         # Make sure the CSR has a valid public key
         raise Bullion::Acme::Errors::BadCsr unless csr.verify(csr.public_key)
 
         return false unless order.ready_status?
-        raise Bullion::Acme::Errors::BadCsr unless csr_domains.include?(csr_cn)
+        raise Bullion::Acme::Errors::BadCsr if csr_cn && !csr_domains.include?(csr_cn)
         raise Bullion::Acme::Errors::BadCsr unless csr_domains.sort == order.domains.sort
 
         true

data/lib/bullion/helpers/ssl.rb

@@ -3,6 +3,7 @@
 module Bullion
   module Helpers
     # SSL-related helper methods
+    # rubocop:disable Metrics/ModuleLength
     module Ssl
       # Converts the incoming key data to an OpenSSL public key usable to verify JWT signatures
       def openssl_compat(key_data)
@@ -11,6 +12,8 @@ module Bullion
           key_data_to_rsa(key_data)
         when "EC"
           key_data_to_ecdsa(key_data)
+        when "OKP"
+          key_data_to_eddsa(key_data)
         end
       end
 
@@ -58,6 +61,24 @@ module Bullion
         OpenSSL::PKey::EC.new(outer_sequence.to_der)
       end
 
+      def key_data_to_eddsa(key_data)
+        curve = key_data["crv"]
+        x = base64_to_octet(key_data["x"])
+
+        # For JWT verification with jwt-eddsa gem, we need Ed25519::VerifyKey
+        case curve
+        when "Ed25519"
+          # The raw public key bytes are exactly what Ed25519::VerifyKey expects
+          Ed25519::VerifyKey.new(x)
+        when "Ed448"
+          # Ed448 not currently supported by the ed25519 gem
+          raise Bullion::Acme::Errors::BadPublicKey,
+                "EdDSA with Ed448 is not supported; only Ed25519 is supported"
+        else
+          raise Bullion::Acme::Errors::BadPublicKey, "Unsupported EdDSA curve: #{curve}"
+        end
+      end
+
       def base64_to_long(data)
         Base64.urlsafe_decode64(data).to_s.unpack("C*").map do |byte|
           to_hex(byte)
@@ -69,6 +90,9 @@ module Bullion
       end
 
       def digest_from_alg(alg)
+        # EdDSA doesn't use a separate digest step
+        return nil if alg.downcase == "eddsa"
+
         if alg.end_with?("256")
           OpenSSL::Digest.new("SHA256")
         elsif alg.end_with?("384")
@@ -127,9 +151,7 @@ module Bullion
         )
 
         # Alternate Names
-        cn = cn_from_csr(csr)
-        existing_sans = filter_sans(csr_sans(csr))
-        valid_alts = (["DNS:#{cn}"] + [*existing_sans]).uniq
+        valid_alts = build_valid_alt_names(csr)
 
         new_cert.add_extension(ef.create_extension("subjectAltName", valid_alts.join(",")))
 
@@ -137,21 +159,6 @@ module Bullion
         [new_cert, valid_alts]
       end
 
-      def csr_sans(csr)
-        raw_attributes = csr.attributes
-        return [] unless raw_attributes
-
-        seq = extract_csr_attrs(csr)
-        return [] unless seq
-
-        values = extract_san_values(seq)
-        return [] unless values
-
-        values = OpenSSL::ASN1.decode(values).value
-
-        values.select { |v| v.tag == 2 }.map { |v| "DNS:#{v.value}" }
-      end
-
       def extract_csr_attrs(csr)
         csr.attributes.select { |a| a.oid == "extReq" }.map { |a| a.value.map(&:value) }
       end
@@ -161,8 +168,9 @@ module Bullion
       end
 
       def extract_csr_domains(csr_sans)
-        csr_decoded_sans = OpenSSL::ASN1.decode(csr_sans.first.value[1].value)
-        csr_decoded_sans.select { |v| v.tag == 2 }.map(&:value)
+        subject_alt_names = csr_sans.first.value.find { |v| v.tag == 4 }
+        csr_decoded_sans = OpenSSL::ASN1.decode(subject_alt_names.value)
+        csr_decoded_sans.value.select { |v| v.tag == 2 }.map(&:value)
       end
 
       def extract_san_values(sequence)
@@ -184,13 +192,33 @@ module Bullion
       end
 
       def cn_from_csr(csr)
-        if csr.subject.to_s
-          cns = csr.subject.to_s.split("/").grep(/^CN=/)
+        return unless csr.subject.to_s
 
-          return cns.first.split("=").last if cns && !cns.empty?
-        end
+        cns = csr.subject.to_s.split("/").grep(/^CN=/)
+
+        cns.first.split("=").last if cns && !cns.empty?
+      end
+
+      def cn_or_first_san_from_csr(csr)
+        cn = cn_from_csr(csr)
+        return cn if cn
+
+        csr_attrs = extract_csr_attrs(csr)
+        csr_sans = extract_csr_sans(csr_attrs)
+        extract_csr_domains(csr_sans).first
+      end
+
+      def domains_from_csr(csr)
+        csr_attrs = extract_csr_attrs(csr)
+        csr_sans = extract_csr_sans(csr_attrs)
+        extract_csr_domains(csr_sans)
+      end
 
-        csr_sans(csr).first.split(":").last
+      def build_valid_alt_names(csr)
+        cn = cn_or_first_san_from_csr(csr)
+        csr_domains = domains_from_csr(csr)
+        existing_sans = filter_sans(csr_domains).map { |d| "DNS:#{d}" }
+        (["DNS:#{cn}"] + [*existing_sans]).uniq
       end
 
       # Signs an ACME CSR
@@ -206,7 +234,7 @@ module Bullion
         csr_cert.not_after = csr_cert.not_before + (3 * 30 * 24 * 60 * 60)
 
         # Force a subject if the cert doesn't have one
-        cert.subject = simple_subject(cn_from_csr(csr)) unless cert.subject
+        cert.subject = simple_subject(cn_or_first_san_from_csr(csr)) unless cert.subject
 
         csr_cert.subject = simple_subject(cert.subject.to_s)
 
@@ -227,5 +255,6 @@ module Bullion
       end
       # rubocop:enable Metrics/AbcSize
     end
+    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/bullion/models/challenge.rb

@@ -50,7 +50,17 @@ module Bullion
 
       def lexicographically_ordered_public_key
         jwk = authorization.order.account.public_key
-        [["e", jwk["e"]], ["kty", jwk["kty"]], ["n", jwk["n"]]].to_h
+        case jwk["kty"]
+        when "RSA"
+          [["e", jwk["e"]], ["kty", jwk["kty"]], ["n", jwk["n"]]].to_h
+        when "EC"
+          [["crv", jwk["crv"]], ["kty", jwk["kty"]], ["x", jwk["x"]], ["y", jwk["y"]]].to_h
+        when "OKP"
+          [["crv", jwk["crv"]], ["kty", jwk["kty"]], ["x", jwk["x"]]].to_h
+        else
+          # Fallback for unknown types
+          jwk.sort.to_h
+        end
       end
     end
   end

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.11.0"
+  VERSION = "0.11.2"
 end

data/lib/bullion.rb

@@ -7,6 +7,7 @@ require "securerandom"
 require "time"
 require "logger"
 require "openssl"
+require "bigdecimal"
 
 # External requirements
 require "benchmark"
@@ -17,6 +18,8 @@ require "sinatra/custom_logger"
 require "trilogy"
 require "sinatra/activerecord"
 require "jwt"
+require "jwt/eddsa"
+require "ed25519"
 require "prometheus/client"
 require "httparty"
 
@@ -68,7 +71,11 @@ module Bullion
   MetricsRegistry = Prometheus::Client.registry
 
   def self.ca_key
-    @ca_key ||= OpenSSL::PKey::RSA.new(File.read(config.ca.key_path), config.ca.secret)
+    @ca_key ||= begin
+      OpenSSL::PKey::RSA.new(File.read(config.ca.key_path), config.ca.secret)
+    rescue OpenSSL::PKey::RSAError
+      OpenSSL::PKey::EC.new(File.read(config.ca.key_path), config.ca.secret)
+    end
   end
 
   def self.ca_cert_file

data/scripts/docker-entrypoint.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
 
 # Starts the server
-rake db:migrate
 itsi

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bullion
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.2
 platform: ruby
 authors:
 - Jonathan Gnagy
@@ -93,6 +93,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.7'
+- !ruby/object:Gem::Dependency
+  name: jwt-eddsa
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
 - !ruby/object:Gem::Dependency
   name: openssl
   requirement: !ruby/object:Gem::Requirement