jwt-eddsa 0.2.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 397516e999d09d5630932c9e83855bdcdca32a4ce1ea5c3727bc8a69cdf0488a
-  data.tar.gz: 120eb2ca3c66104aa8023063c96077e7e3b158388f292b766546d58eb86c8a09
+  metadata.gz: 8a9054ac4598241fed14b327b76854fb9dd57034947c2dc94d7ffd70a3b9667f
+  data.tar.gz: 79ace7fb4cde12fa7fef53cdec3631be1b1be4c7f9e2acd40976b15228050152
 SHA512:
-  metadata.gz: 7da8d363b401a7d741539941d99be57eca69fb1c2a09cf8d6eaa0431da4346952e8d4711df1518bee69cce5bf77d762d6ea45e0e2cbb4bd0a96e581019b164a3
-  data.tar.gz: 5027b733b26cc75604395f972db17eadfe6757219a749ed1094e0bbcfa8a056bcc49cca060dc14ea71cb33c844485324a742acd793003b4445cac0fec8b4141f
+  metadata.gz: 55ffed5f3d15b636699d1eb8c20058a9d99c5f854de01efe1b06481aacee9f8e086fea6700c4ebc5e19e62139e3d4c9b31c81b160eab7e240cb2244c8a8e15da
+  data.tar.gz: d5f6976cba0e2eec62baae85abdad9c175937c90787a74d627b950e57a641869e2a562ef6e246b9b32e34379ab411e1e55d726d1130644eee667e637844485e1

data/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.5.0"
+}

data/.rubocop.yml

@@ -12,3 +12,4 @@ Style/StringLiteralsInInterpolation:
 Metrics/BlockLength:
   Exclude:
     - spec/**/*_spec.rb
+    - '*.gemspec'

data/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [0.5.0](https://github.com/anakinj/jwt-eddsa/compare/v0.4.0...v0.5.0) (2024-08-02)
+
+
+### Features
+
+* Initial release ([d7ce4d3](https://github.com/anakinj/jwt-eddsa/commit/d7ce4d3885a1fbe0e268a672a52d4ed8b7c558d2))
+* Release using release-please ([d450241](https://github.com/anakinj/jwt-eddsa/commit/d45024107095270ad6bafc0a638f154c0cb4d763))
+* Still trying to configure release-please ([fcfe5cc](https://github.com/anakinj/jwt-eddsa/commit/fcfe5cc0c5ff18ea296a64d78db3fe073d667190))
+
+## [0.4.0](https://github.com/anakinj/jwt-eddsa/compare/jwt-eddsa-v0.3.0...jwt-eddsa/v0.4.0) (2024-08-02)
+
+
+### Features
+
+* Initial release ([d7ce4d3](https://github.com/anakinj/jwt-eddsa/commit/d7ce4d3885a1fbe0e268a672a52d4ed8b7c558d2))
+* Release using release-please ([d450241](https://github.com/anakinj/jwt-eddsa/commit/d45024107095270ad6bafc0a638f154c0cb4d763))
+* Still trying to configure release-please ([fcfe5cc](https://github.com/anakinj/jwt-eddsa/commit/fcfe5cc0c5ff18ea296a64d78db3fe073d667190))
+
+## [0.3.0](https://github.com/anakinj/jwt-eddsa/compare/v0.2.0...v0.3.0) (2024-08-02)
+
+
+### Features
+
+* Initial release ([d7ce4d3](https://github.com/anakinj/jwt-eddsa/commit/d7ce4d3885a1fbe0e268a672a52d4ed8b7c558d2))
+
 ## [v0.0.1](https://github.com/anakinj/jwt-eddsa/tree/v0.0.1) (NEXT)
 
 [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.8.2...main)
@@ -11,4 +36,4 @@
 
 **Fixes and enhancements:**
 
-- Your contribution here
+- Your contribution here

data/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2024 TODO: Write your name
+Copyright (c) 2024 Joakim Antman
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -1,6 +1,9 @@
 # jwt-eddsa
 
-A library extending the ruby-jwt gem with EdDSA algorithms
+[![Gem Version](https://badge.fury.io/rb/jwt-eddsa.svg)](https://badge.fury.io/rb/jwt-eddsa)
+[![Build Status](https://github.com/anakinj/jwt-eddsa/workflows/test/badge.svg?branch=main)](https://github.com/jwt/ruby-jwt/actions)
+
+A library extending the ruby-jwt gem with EdDSA algorithms. Based on [RFC 8037](https://datatracker.ietf.org/doc/html/rfc8037).
 
 **NOTE: This gem is still WIP**
 
@@ -13,6 +16,7 @@ Plan is to replace rbnacl with something else in the near future.
 Will only work with the WIP branch, so adding the following to your the Gemfile should do the trick:
 ```
 gem "jwt", github: "anakinj/ruby-jwt", branch: "extendable-algos"
+gem "jwt-eddsa"
 ```
 
 ```
@@ -31,7 +35,7 @@ payload, header = JWT.decode(token, private_key.verify_key, true, algorithm: "Ed
 
 ```
 bundle install
-bundle exec rspec
+bundle exec rake
 ```
 
 ## Contributing

data/Rakefile

@@ -10,3 +10,12 @@ require "rubocop/rake_task"
 RuboCop::RakeTask.new
 
 task default: %i[spec rubocop]
+
+task :check_version do
+  require_relative "lib/jwt/eddsa/version"
+  version = ENV.fetch("GEM_VERSION", nil)
+
+  raise "Version mismatch: #{JWT::EdDSA::VERSION} != #{version}" if version != JWT::EdDSA::VERSION
+end
+
+Rake::Task[:build].enhance([:check_version]) if ENV["CI"]

data/lib/jwt/eddsa/algo.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module JWT
+  module EdDSA
+    # EdDSA algorithm implementation
+    module Algo
+      include JWT::JWA::Algorithm
+
+      register_algorithm("EdDSA")
+
+      class << self
+        def sign(_algorithm, msg, key)
+          unless key.is_a?(RbNaCl::Signatures::Ed25519::SigningKey)
+            raise_sign_error!("Key given is a #{key.class} but needs to be a " \
+                              "RbNaCl::Signatures::Ed25519::SigningKey")
+          end
+
+          key.sign(msg)
+        end
+
+        def verify(_algorithm, public_key, signing_input, signature)
+          unless public_key.is_a?(RbNaCl::Signatures::Ed25519::VerifyKey)
+            raise_verify_error!("Key given is a #{public_key.class} but needs to be a " \
+                                "RbNaCl::Signatures::Ed25519::VerifyKey")
+          end
+
+          public_key.verify(signature, signing_input)
+        rescue RbNaCl::CryptoError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/jwt/eddsa/jwk/okp.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+module JWT
+  module EdDSA
+    module JWK
+      # https://datatracker.ietf.org/doc/html/rfc8037
+      class OKP < ::JWT::JWK::KeyBase
+        KTY  = "OKP"
+        KTYS = [KTY, JWT::EdDSA::JWK::OKP, RbNaCl::Signatures::Ed25519::SigningKey,
+                RbNaCl::Signatures::Ed25519::VerifyKey].freeze
+        OKP_PUBLIC_KEY_ELEMENTS = %i[kty n x].freeze
+        OKP_PRIVATE_KEY_ELEMENTS = %i[d].freeze
+
+        def initialize(key, params = nil, options = {})
+          params ||= {}
+          # For backwards compatibility when kid was a String
+          params = { kid: params } if params.is_a?(String)
+
+          key_params = extract_key_params(key)
+
+          params = params.transform_keys(&:to_sym)
+          check_jwk_params!(key_params, params)
+          super(options, key_params.merge(params))
+        end
+
+        def verify_key
+          return @verify_key if defined?(@verify_key)
+
+          @verify_key = verify_key_from_parameters
+        end
+
+        def signing_key
+          return @signing_key if defined?(@signing_key)
+
+          @signing_key = signing_key_from_parameters
+        end
+
+        def key_digest
+          ::JWT::JWK::Thumbprint.new(self).to_s
+        end
+
+        def private?
+          !signing_key.nil?
+        end
+
+        def members
+          OKP_PUBLIC_KEY_ELEMENTS.each_with_object({}) { |i, h| h[i] = self[i] }
+        end
+
+        def export(options = {})
+          exported = parameters.clone
+          unless private? && options[:include_private] == true
+            exported.reject! do |k, _|
+              OKP_PRIVATE_KEY_ELEMENTS.include?(k)
+            end
+          end
+          exported
+        end
+
+        private
+
+        def extract_key_params(key) # rubocop:disable Metrics/MethodLength
+          case key
+          when JWT::JWK::KeyBase
+            key.export(include_private: true)
+          when RbNaCl::Signatures::Ed25519::SigningKey
+            @signing_key = key
+            @verify_key = key.verify_key
+            parse_okp_key_params(@verify_key, @signing_key)
+          when RbNaCl::Signatures::Ed25519::VerifyKey
+            @signing_key = nil
+            @verify_key = key
+            parse_okp_key_params(@verify_key)
+          when Hash
+            key.transform_keys(&:to_sym)
+          else
+            raise ArgumentError,
+                  "key must be of type RbNaCl::Signatures::Ed25519::SigningKey, " \
+                  "RbNaCl::Signatures::Ed25519::VerifyKey " \
+                  "or Hash with key parameters"
+          end
+        end
+
+        def check_jwk_params!(key_params, _given_params)
+          return if key_params[:kty] == KTY
+
+          raise JWT::JWKError,
+                "Incorrect 'kty' value: #{key_params[:kty]}, expected #{KTY}"
+        end
+
+        def parse_okp_key_params(verify_key, signing_key = nil)
+          params = {
+            kty: KTY,
+            crv: "Ed25519",
+            x: ::Base64.urlsafe_encode64(verify_key.to_bytes, padding: false)
+          }
+
+          params[:d] = ::Base64.urlsafe_encode64(signing_key.to_bytes, padding: false) if signing_key
+
+          params
+        end
+
+        def verify_key_from_parameters
+          RbNaCl::Signatures::Ed25519::VerifyKey.new(::Base64.urlsafe_decode64(self[:x]))
+        end
+
+        def signing_key_from_parameters
+          return nil unless self[:d]
+
+          RbNaCl::Signatures::Ed25519::SigningKey.new(::Base64.urlsafe_decode64(self[:d]))
+        end
+
+        class << self
+          def import(jwk_data)
+            new(jwk_data)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/jwt/eddsa/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module JWT
-  module Eddsa
-    VERSION = "0.2.0"
+  module EdDSA
+    VERSION = "0.5.0"
   end
 end

data/lib/jwt/eddsa.rb

@@ -1,33 +1,7 @@
 # frozen_string_literal: true
 
 require "jwt"
-require_relative "eddsa/version"
-
-module JWT
-  # EdDSA algorithm implementation
-  module Eddsa
-    include JWT::JWA::Algorithm
-
-    register_algorithm("EdDSA")
-
-    class << self
-      def sign(_algorithm, msg, key)
-        unless key.is_a?(RbNaCl::Signatures::Ed25519::SigningKey)
-          raise_sign_error!("Key given is a #{key.class} but needs to be a RbNaCl::Signatures::Ed25519::SigningKey")
-        end
 
-        key.sign(msg)
-      end
-
-      def verify(_algorithm, public_key, signing_input, signature)
-        unless public_key.is_a?(RbNaCl::Signatures::Ed25519::VerifyKey)
-          raise_verify_error!("Key given is a #{public_key.class} but needs to be a RbNaCl::Signatures::Ed25519::VerifyKey")
-        end
-
-        public_key.verify(signature, signing_input)
-      rescue RbNaCl::CryptoError
-        false
-      end
-    end
-  end
-end
+require_relative "eddsa/version"
+require_relative "eddsa/jwk/okp"
+require_relative "eddsa/algo"

data/release-please-config.json

@@ -0,0 +1,9 @@
+{
+  "release-type": "ruby",
+  "include-v-in-tag": true,
+  "packages": {
+    ".": {
+      "version-file": "lib/jwt/eddsa/version.rb"
+    }
+  }
+}

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: jwt-eddsa
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Joakim Antman
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-08-01 00:00:00.000000000 Z
+date: 2024-08-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
@@ -38,13 +52,14 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '6.0'
-description: 
+description: Extends the ruby-jwt gem with EdDSA signing, verification and JWK importing/exporting
 email:
 - antmanj@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".release-please-manifest.json"
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-version"
@@ -54,14 +69,17 @@ files:
 - README.md
 - Rakefile
 - lib/jwt/eddsa.rb
+- lib/jwt/eddsa/algo.rb
+- lib/jwt/eddsa/jwk/okp.rb
 - lib/jwt/eddsa/version.rb
+- release-please-config.json
 homepage: https://github.com/anakinj/jwt-eddsa
 licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/anakinj/jwt-eddsa
   source_code_uri: https://github.com/anakinj/jwt-eddsa
-  changelog_uri: https://github.com/anakinj/jwt-eddsablob/v0.2.0/CHANGELOG.md
+  changelog_uri: https://github.com/anakinj/jwt-eddsa/blob/v0.5.0/CHANGELOG.md
   rubygems_mfa_required: 'true'
 post_install_message: 
 rdoc_options: []
@@ -81,5 +99,5 @@ requirements: []
 rubygems_version: 3.5.11
 signing_key: 
 specification_version: 4
-summary: Extension for the jwt gem
+summary: jwt EdDSA algorithm extension
 test_files: []