jwt-eddsa 0.9.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d176aca754fd2612a100a6dbccc5cb7452258d61113899aef72bbfeffd8a35a0
-  data.tar.gz: d9b57d2a032a47bc8bcf313782652c7f7e5404639dff0a230a20d0b9d27d42c5
+  metadata.gz: 3fd1fa6708f4279dfe06ff4791c7deb54acfa4bd780908d11a38a163d3a805a1
+  data.tar.gz: 48ecc05c4127c72ac7ef0ea65aa142ad4ea69aab18763a7a73183118b87514c3
 SHA512:
-  metadata.gz: 3ac0969bd6a41c3ee85cedaf88b1183743fafcf42a5eddef4dc3736be013578a3d9d79b6fe1e69dab327632b84a5d185c33e925d538636d055fcb1196f03e05f
-  data.tar.gz: e5aeb285f6c04b604713bd63ab58dc41ac3d24c6c7617382e09774f81c094f5f4966385a7ac3a3692bfba87ceaab4bd8fecb1f56446d6289e11d0e037a352500
+  metadata.gz: feb697c45c25e28a42c874a065afdfc92a72f45f5ac16905c7e12f08f4ccbfcf5844bfd12c440eec03819956b87dbccd0f6cefbe2dd82374b91a476db31b0c99
+  data.tar.gz: 3e3ab7aaf6daeeecb37780f31b7648370cab56f46ae4eea2390719c83040682c4af349fa5935c945f06fca672d0183a911e5dd9c54aa0913f86fba52f614b0bb

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.9.0"
+  ".": "1.1.0"
 }

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [1.1.0](https://github.com/jwt/ruby-jwt-eddsa/compare/v1.0.0...v1.1.0) (2026-11-04)
+
+
+### Bug Fixes
+
+* allow exporting OKP JWKs with unsupported curves ([#32](https://github.com/jwt/ruby-jwt-eddsa/issues/32)) ([9f26d0d](https://github.com/jwt/ruby-jwt-eddsa/commit/9f26d0db5eb69a91377a82a7f8cc21a7ae991c2c))
+* reject unsupported OKP curves ([#29](https://github.com/jwt/ruby-jwt-eddsa/issues/29)) ([032cfa9](https://github.com/jwt/ruby-jwt-eddsa/commit/032cfa925ad6e123712edf2c83723a873bc6f4e7))
+
+## [1.0.0](https://github.com/jwt/ruby-jwt-eddsa/compare/v0.9.0...v1.0.0) (2026-08-14)
+
+
+### ⚠ BREAKING CHANGES
+
+* Auto-generated `kid` values for OKP JWKs are now computed from the RFC 8037 required members (crv, kty, x) instead of the incorrect (kty, n, x). Previously generated kid values will no longer match; keys with an explicitly provided kid are unaffected.
+
+### Bug Fixes
+
+* Change OKP JWK thumbprint to use crv/kty/x, not RSA's kty/n/x ([#26](https://github.com/jwt/ruby-jwt-eddsa/issues/26)) ([7760623](https://github.com/jwt/ruby-jwt-eddsa/commit/77606230f99ec6f7ec5ebaab939451fea0652bff))
+* OKP JWK kid values now follow RFC 8037 thumbprints ([#26](https://github.com/jwt/ruby-jwt-eddsa/issues/26)) ([6eaf654](https://github.com/jwt/ruby-jwt-eddsa/commit/6eaf654750666d9c3122b46629eeaf9115971694))
+
 ## [0.9.0](https://github.com/jwt/ruby-jwt-eddsa/compare/v0.8.1...v0.9.0) (2025-06-28)
 
 

data/README.md

@@ -27,6 +27,11 @@ token = JWT.encode({pay: "load"}, private_key, "EdDSA")
 payload, header = JWT.decode(token, private_key.verify_key, true, algorithm: "EdDSA")
 ```
 
+OKP JWKs must specify `crv: "Ed25519"` to provide a signing or verification key.
+Requesting a key with a missing or unsupported curve (including `X25519` and
+`Ed448`) raises `JWT::JWKError`. Such JWKs can still be imported, so an unrelated
+key in a mixed JWKS does not prevent verification with a selected Ed25519 key.
+
 ## Development
 
 ```

data/lib/jwt/eddsa/jwk/okp.rb

@@ -7,7 +7,7 @@ module JWT
       class OKP < ::JWT::JWK::KeyBase
         KTY  = "OKP"
         KTYS = [KTY, JWT::EdDSA::JWK::OKP, Ed25519::SigningKey, Ed25519::VerifyKey].freeze
-        OKP_PUBLIC_KEY_ELEMENTS = %i[kty n x].freeze
+        OKP_PUBLIC_KEY_ELEMENTS = %i[crv kty x].freeze
         OKP_PRIVATE_KEY_ELEMENTS = %i[d].freeze
 
         def initialize(key, params = nil, options = {})
@@ -23,12 +23,14 @@ module JWT
         end
 
         def verify_key
+          check_curve!
           return @verify_key if defined?(@verify_key)
 
           @verify_key = verify_key_from_parameters
         end
 
         def signing_key
+          check_curve!
           return @signing_key if defined?(@signing_key)
 
           @signing_key = signing_key_from_parameters
@@ -39,7 +41,7 @@ module JWT
         end
 
         def private?
-          !signing_key.nil?
+          !self[:d].nil?
         end
 
         def members
@@ -93,6 +95,13 @@ module JWT
                 "Incorrect 'kty' value: #{key_params[:kty]}, expected #{KTY}"
         end
 
+        def check_curve!
+          return if self[:crv] == "Ed25519"
+
+          raise JWT::JWKError,
+                "Incorrect 'crv' value: #{self[:crv]}, expected Ed25519"
+        end
+
         def parse_okp_key_params(verify_key, signing_key = nil)
           params = {
             kty: KTY,

data/lib/jwt/eddsa/version.rb

@@ -2,6 +2,6 @@
 
 module JWT
   module EdDSA
-    VERSION = "0.9.0"
+    VERSION = "1.1.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt-eddsa
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Joakim Antman
@@ -78,7 +78,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/jwt/ruby-jwt-eddsa
   source_code_uri: https://github.com/jwt/ruby-jwt-eddsa
-  changelog_uri: https://github.com/jwt/ruby-jwt-eddsa/blob/v0.9.0/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwt-eddsa/blob/v1.1.0/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -94,7 +94,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.16
 specification_version: 4
 summary: EdDSA algorithm extension for ruby-jwt
 test_files: []