bullion 0.11.1 → 0.11.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8821e563a9452dbd524f1bdfbd2f944ee4a3d0c071e57bab6d5f9b2c61e18555
-  data.tar.gz: d31913ae560676de68a57ea6aa308126a6d3c92c7a3da69d4d882e032ed56196
+  metadata.gz: 95ab410d446f9be5b65083d059c91636f5c4ee801b2973536387bb001623a0b2
+  data.tar.gz: 87f492721aaf01a88c746bed6e70d5709c19c7ba3192a7ae83d6c628e716a0dd
 SHA512:
-  metadata.gz: 4bcabcb78421e92a48fbd5485631de98bee3bf0d4452ba5d9c08eb04d34ac171934b073e0a441b5dc95aeeb353765a5445188ca7011b98d3e2f376d130aaf2d4
-  data.tar.gz: 5541be539b018f62d1e466e51ada7985f5e37ee460eb98c4e344f79c443aa60fa3f8b2bf1d26d169a15c0b8efef38c7523c4023a416436e85654b585a5fcae6c
+  metadata.gz: 1ce61712fb1ee5ce6139bb6e105b242709c8f51eece706e116a4cff94f7361c3c7f9589598cc25373695f1df35f60b06866303f96872e1dc516748068fef338c
+  data.tar.gz: e69f33f2ee12e17572ad6ad2054a5123d7a1fe3f37471bd64432752b6b0df75892e1fba19004144349810cfae28bafb0ce23039d8cb53613f2ac9d66603eb8d1

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.11.1"
+  ".": "0.11.2"
 }

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.11.2](https://github.com/jgnagy/bullion/compare/bullion/v0.11.1...bullion/v0.11.2) (2026-02-16)
+
+
+### Features
+
+* add EdDSA (Ed25519) JWT signature support ([bba2985](https://github.com/jgnagy/bullion/commit/bba29851e1c5644152f4a3e82d82c6c1d5c5ce5e))
+* add EdDSA (Ed25519) JWT signature support ([77a2f5b](https://github.com/jgnagy/bullion/commit/77a2f5bfc30db3527ad3fe75136b210956279957)), closes [#3](https://github.com/jgnagy/bullion/issues/3)
+* Add test coverage for Ed25519 certificate signing ([59f0f74](https://github.com/jgnagy/bullion/commit/59f0f74a039292a5d804c8e49a880f20ab5d0c1b))
+
+
+### Bug Fixes
+
+* return proper badPublicKey error for Ed448 ([a21414f](https://github.com/jgnagy/bullion/commit/a21414f66075d47e2b5613d2034fa806a0a78602))
+
 ## [0.11.1](https://github.com/jgnagy/bullion/compare/bullion/v0.11.0...bullion/v0.11.1) (2025-08-24)
 
 

data/Gemfile.lock

@@ -1,13 +1,14 @@
 PATH
   remote: .
   specs:
-    bullion (0.11.1)
+    bullion (0.11.2)
       benchmark (~> 0.4)
       dry-configurable (~> 1.1)
       httparty (~> 0.21)
       itsi (~> 0.2)
       json (~> 2.6)
       jwt (~> 2.7)
+      jwt-eddsa (~> 0.9)
       openssl (~> 3.0)
       prometheus-client (~> 4.2)
       sinatra (~> 3.1)
@@ -46,7 +47,7 @@ GEM
     backport (1.2.0)
     base64 (0.3.0)
     benchmark (0.4.1)
-    bigdecimal (3.2.2)
+    bigdecimal (4.0.1)
     byebug (11.1.3)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.3)
@@ -61,15 +62,16 @@ GEM
       concurrent-ruby (~> 1.0)
       logger
       zeitwerk (~> 2.6)
-    faraday (2.13.4)
+    ed25519 (1.4.0)
+    faraday (2.14.1)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.1)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.4.2)
+      net-http (~> 0.5)
     faraday-retry (2.3.2)
       faraday (~> 2.0)
-    httparty (0.23.1)
+    httparty (0.24.0)
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
@@ -86,9 +88,13 @@ GEM
       rack (>= 1.6)
       rb_sys (~> 0.9.91)
     jaro_winkler (1.6.1)
-    json (2.13.2)
+    json (2.18.1)
     jwt (2.10.2)
       base64
+    jwt-eddsa (0.9.0)
+      base64
+      ed25519
+      jwt (>= 2.9.0)
     kramdown (2.5.1)
       rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
@@ -99,12 +105,12 @@ GEM
     mini_mime (1.1.5)
     minitest (5.25.5)
     multi_json (1.17.0)
-    multi_xml (0.7.2)
-      bigdecimal (~> 3.1)
+    multi_xml (0.8.1)
+      bigdecimal (>= 3.1, < 5)
     mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    net-http (0.6.0)
-      uri
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     nokogiri (1.18.9-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.18.9-aarch64-linux-musl)
@@ -132,7 +138,7 @@ GEM
     prometheus-client (4.2.5)
       base64
     racc (1.8.1)
-    rack (2.2.17)
+    rack (2.2.20)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
@@ -148,7 +154,7 @@ GEM
     regexp_parser (2.11.2)
     reverse_markdown (3.0.0)
       nokogiri
-    rexml (3.4.1)
+    rexml (3.4.2)
     rspec (3.13.1)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -245,7 +251,7 @@ GEM
     unicode-display_width (3.1.5)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
-    uri (1.0.3)
+    uri (1.1.1)
     yard (0.9.37)
     yard-solargraph (0.1.0)
       yard (~> 0.9)

data/bullion.gemspec

@@ -32,6 +32,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "itsi",                 "~> 0.2"
   spec.add_dependency "json",                 "~> 2.6"
   spec.add_dependency "jwt",                  "~> 2.7"
+  spec.add_dependency "jwt-eddsa",            "~> 0.9"
   spec.add_dependency "openssl",              "~> 3.0"
   spec.add_dependency "prometheus-client",    "~> 4.2"
   spec.add_dependency "sinatra",              "~> 3.1"

data/lib/bullion/acme/error.rb

@@ -34,6 +34,11 @@ module Bullion
         def acme_type = "badNonce"
       end
 
+      # ACME exception for bad/unsupported public keys
+      class BadPublicKey < Bullion::Acme::Error
+        def acme_type = "badPublicKey"
+      end
+
       # ACME exception for invalid contacts in accounts
       class InvalidContact < Bullion::Acme::Error
         def acme_type = "invalidContact"

data/lib/bullion/helpers/acme.rb

@@ -41,10 +41,11 @@ module Bullion
           JWT.decode(jwt_data, compat_public_key, true, { algorithm: @header_data["alg"] })
         else
           digest = digest_from_alg(@header_data["alg"])
+          alg = @header_data["alg"].downcase
 
-          sig = if @header_data["alg"].downcase.start_with?("es")
+          sig = if alg.start_with?("es")
                   ecdsa_sig_to_der(signature)
-                elsif @header_data["alg"].downcase.start_with?("rs")
+                elsif alg.start_with?("rs") || alg == "eddsa"
                   Base64.urlsafe_decode64(signature)
                 end
 

data/lib/bullion/helpers/ssl.rb

@@ -3,6 +3,7 @@
 module Bullion
   module Helpers
     # SSL-related helper methods
+    # rubocop:disable Metrics/ModuleLength
     module Ssl
       # Converts the incoming key data to an OpenSSL public key usable to verify JWT signatures
       def openssl_compat(key_data)
@@ -11,6 +12,8 @@ module Bullion
           key_data_to_rsa(key_data)
         when "EC"
           key_data_to_ecdsa(key_data)
+        when "OKP"
+          key_data_to_eddsa(key_data)
         end
       end
 
@@ -58,6 +61,24 @@ module Bullion
         OpenSSL::PKey::EC.new(outer_sequence.to_der)
       end
 
+      def key_data_to_eddsa(key_data)
+        curve = key_data["crv"]
+        x = base64_to_octet(key_data["x"])
+
+        # For JWT verification with jwt-eddsa gem, we need Ed25519::VerifyKey
+        case curve
+        when "Ed25519"
+          # The raw public key bytes are exactly what Ed25519::VerifyKey expects
+          Ed25519::VerifyKey.new(x)
+        when "Ed448"
+          # Ed448 not currently supported by the ed25519 gem
+          raise Bullion::Acme::Errors::BadPublicKey,
+                "EdDSA with Ed448 is not supported; only Ed25519 is supported"
+        else
+          raise Bullion::Acme::Errors::BadPublicKey, "Unsupported EdDSA curve: #{curve}"
+        end
+      end
+
       def base64_to_long(data)
         Base64.urlsafe_decode64(data).to_s.unpack("C*").map do |byte|
           to_hex(byte)
@@ -69,6 +90,9 @@ module Bullion
       end
 
       def digest_from_alg(alg)
+        # EdDSA doesn't use a separate digest step
+        return nil if alg.downcase == "eddsa"
+
         if alg.end_with?("256")
           OpenSSL::Digest.new("SHA256")
         elsif alg.end_with?("384")
@@ -231,5 +255,6 @@ module Bullion
       end
       # rubocop:enable Metrics/AbcSize
     end
+    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/bullion/models/challenge.rb

@@ -50,7 +50,17 @@ module Bullion
 
       def lexicographically_ordered_public_key
         jwk = authorization.order.account.public_key
-        [["e", jwk["e"]], ["kty", jwk["kty"]], ["n", jwk["n"]]].to_h
+        case jwk["kty"]
+        when "RSA"
+          [["e", jwk["e"]], ["kty", jwk["kty"]], ["n", jwk["n"]]].to_h
+        when "EC"
+          [["crv", jwk["crv"]], ["kty", jwk["kty"]], ["x", jwk["x"]], ["y", jwk["y"]]].to_h
+        when "OKP"
+          [["crv", jwk["crv"]], ["kty", jwk["kty"]], ["x", jwk["x"]]].to_h
+        else
+          # Fallback for unknown types
+          jwk.sort.to_h
+        end
       end
     end
   end

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.11.1"
+  VERSION = "0.11.2"
 end

data/lib/bullion.rb

@@ -18,6 +18,8 @@ require "sinatra/custom_logger"
 require "trilogy"
 require "sinatra/activerecord"
 require "jwt"
+require "jwt/eddsa"
+require "ed25519"
 require "prometheus/client"
 require "httparty"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bullion
 version: !ruby/object:Gem::Version
-  version: 0.11.1
+  version: 0.11.2
 platform: ruby
 authors:
 - Jonathan Gnagy
@@ -93,6 +93,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.7'
+- !ruby/object:Gem::Dependency
+  name: jwt-eddsa
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
 - !ruby/object:Gem::Dependency
   name: openssl
   requirement: !ruby/object:Gem::Requirement