jwt-eddsa 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e0c7782f28dacc294cb88e798dae9cced68e830611db8dafcea81198eef41fd
-  data.tar.gz: 27f2fc7a7d23b096dc9236e33c54ebb5617756909bd7788474c71dd8939ff70b
+  metadata.gz: 3fd1fa6708f4279dfe06ff4791c7deb54acfa4bd780908d11a38a163d3a805a1
+  data.tar.gz: 48ecc05c4127c72ac7ef0ea65aa142ad4ea69aab18763a7a73183118b87514c3
 SHA512:
-  metadata.gz: 0e38a6608c55930fb1e46fdf3a3d2c8422f502c428a34927aa28a7081f81134e1e2f8442de405f033941fbad2979e9d7f9c41bb6ffe3dcdcbc44e6701a265431
-  data.tar.gz: 8f21eade2696ed13fbdbe11c33e784701e9a73ee7b7d3593170f26505d95be366ab79393809f1dee912096f504dec971b1c5f75023790b92d617c60b653bd28f
+  metadata.gz: feb697c45c25e28a42c874a065afdfc92a72f45f5ac16905c7e12f08f4ccbfcf5844bfd12c440eec03819956b87dbccd0f6cefbe2dd82374b91a476db31b0c99
+  data.tar.gz: 3e3ab7aaf6daeeecb37780f31b7648370cab56f46ae4eea2390719c83040682c4af349fa5935c945f06fca672d0183a911e5dd9c54aa0913f86fba52f614b0bb

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.0.0"
+  ".": "1.1.0"
 }

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.1.0](https://github.com/jwt/ruby-jwt-eddsa/compare/v1.0.0...v1.1.0) (2026-11-04)
+
+
+### Bug Fixes
+
+* allow exporting OKP JWKs with unsupported curves ([#32](https://github.com/jwt/ruby-jwt-eddsa/issues/32)) ([9f26d0d](https://github.com/jwt/ruby-jwt-eddsa/commit/9f26d0db5eb69a91377a82a7f8cc21a7ae991c2c))
+* reject unsupported OKP curves ([#29](https://github.com/jwt/ruby-jwt-eddsa/issues/29)) ([032cfa9](https://github.com/jwt/ruby-jwt-eddsa/commit/032cfa925ad6e123712edf2c83723a873bc6f4e7))
+
 ## [1.0.0](https://github.com/jwt/ruby-jwt-eddsa/compare/v0.9.0...v1.0.0) (2026-08-14)
 
 

data/README.md

@@ -27,6 +27,11 @@ token = JWT.encode({pay: "load"}, private_key, "EdDSA")
 payload, header = JWT.decode(token, private_key.verify_key, true, algorithm: "EdDSA")
 ```
 
+OKP JWKs must specify `crv: "Ed25519"` to provide a signing or verification key.
+Requesting a key with a missing or unsupported curve (including `X25519` and
+`Ed448`) raises `JWT::JWKError`. Such JWKs can still be imported, so an unrelated
+key in a mixed JWKS does not prevent verification with a selected Ed25519 key.
+
 ## Development
 
 ```

data/lib/jwt/eddsa/jwk/okp.rb

@@ -23,12 +23,14 @@ module JWT
         end
 
         def verify_key
+          check_curve!
           return @verify_key if defined?(@verify_key)
 
           @verify_key = verify_key_from_parameters
         end
 
         def signing_key
+          check_curve!
           return @signing_key if defined?(@signing_key)
 
           @signing_key = signing_key_from_parameters
@@ -39,7 +41,7 @@ module JWT
         end
 
         def private?
-          !signing_key.nil?
+          !self[:d].nil?
         end
 
         def members
@@ -93,6 +95,13 @@ module JWT
                 "Incorrect 'kty' value: #{key_params[:kty]}, expected #{KTY}"
         end
 
+        def check_curve!
+          return if self[:crv] == "Ed25519"
+
+          raise JWT::JWKError,
+                "Incorrect 'crv' value: #{self[:crv]}, expected Ed25519"
+        end
+
         def parse_okp_key_params(verify_key, signing_key = nil)
           params = {
             kty: KTY,

data/lib/jwt/eddsa/version.rb

@@ -2,6 +2,6 @@
 
 module JWT
   module EdDSA
-    VERSION = "1.0.0"
+    VERSION = "1.1.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt-eddsa
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Joakim Antman
@@ -78,7 +78,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/jwt/ruby-jwt-eddsa
   source_code_uri: https://github.com/jwt/ruby-jwt-eddsa
-  changelog_uri: https://github.com/jwt/ruby-jwt-eddsa/blob/v1.0.0/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwt-eddsa/blob/v1.1.0/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: