nonnative 3.43.0 → 3.44.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aaedf40a9f9c58092a97588471ef0b2812c4da4c6302076fe28bb8f52bfe2b30
-  data.tar.gz: 91e5779b4b95b4e2cf9f5b8546a38c9af2ff3bb3ac3aeb4fe23903b92a768f59
+  metadata.gz: 86c81434b301e56014082243bce30a3ebed651adb66bdea4b8d725b040982518
+  data.tar.gz: 57c657c17907418c17392cb2a687e551d5f8830b72ce3cd4d2200eed2b4fb734
 SHA512:
-  metadata.gz: 27eeb19115b61ef97b159ff28deb3429507e8262cc4bf42f005841d30d30de829f9511a9c91ec482e0a5f5a850ccad278cddebe9bda3e1b6f882f977920ecf2c
-  data.tar.gz: 4f57f4f9ed41cfc84e26b4d65b336f589b70d306ff7f041925d74028277976e468bf9c61dbb6519a2856a0da434ba8fb1e283ff3118e22335e47bf3bc21f8ca9
+  metadata.gz: f84551f9e069342560b321958654ebc2bf6f594e72ffc3aea9a3b5d085d3fb71e66c49c5536b76d1f1b8a289328cb9d0e9a9191b4d1a17c26c0c48c388ed785d
+  data.tar.gz: 6f955ecf1da3a0f0d374890ccca21a5414845bceab0b626e00c6d103219d80c66fc61d5d8f12c15a00acc847eaab0ba06fe8152529983409111e84e8727a36be

data/README.md

@@ -225,7 +225,6 @@ Supported `kind` values (all Ed25519, generation only):
 
 - `jwt`: EdDSA JWT with the key id in the `kid` header. `private_key` is a PKCS#8 PEM file.
 - `paseto`: PASETO v4.public with the key id in a `{"kid":"..."}` footer. `private_key` is a PKCS#8 PEM file. Requires system **libsodium** (via `rbnacl`); it loads lazily, so `require 'nonnative'` works without libsodium until you generate a PASETO token.
-- `ssh`: go-service style `base64(claims).base64(signature)` with a raw Ed25519 signature over `v1` claims. `private_key` is an **OpenSSH-format** key. `issuer` and `sub` are ignored (the subject is the key id).
 
 The audience is endpoint-scoped; build it with the helpers:
 
@@ -241,8 +240,6 @@ By default the time claims are pinned to the current time (`iat`/`nbf` at now, `
 token.generate(aud: 'GET /v1/things', sub: 'user-1', not_before: Time.now + 3600)
 ```
 
-`ssh` tokens have no `nbf` claim, so passing `not_before` for the `ssh` kind raises `ArgumentError`.
-
 ### 🔁 Lifecycle strategies (Cucumber integration)
 
 Nonnative ships Cucumber hooks (when loaded) that support these tags/strategies:

data/lib/nonnative/token.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Nonnative
-  # Builds signed tokens (JWT, PASETO, or SSH) for authenticating against services under test.
+  # Builds signed JWT or PASETO tokens for authenticating against services under test.
   #
   # The consumer passes in the signing parameters they parsed from their own configuration; this class
   # is not coupled to any particular service's configuration format. The generated token string is
@@ -20,7 +20,7 @@ module Nonnative
   # @see Nonnative::Header.auth_bearer
   class Token
     # Supported token kinds mapped to their implementation.
-    KINDS = { 'jwt' => Nonnative::JwtToken, 'paseto' => Nonnative::PasetoToken, 'ssh' => Nonnative::SshToken }.freeze
+    KINDS = { 'jwt' => Nonnative::JwtToken, 'paseto' => Nonnative::PasetoToken }.freeze
 
     class << self
       # Builds the audience string for an HTTP endpoint.
@@ -41,10 +41,10 @@ module Nonnative
       end
     end
 
-    # @param kind [String] token kind, one of `"jwt"`, `"paseto"`, or `"ssh"`
-    # @param issuer [String] the `iss` claim (unused by the `ssh` kind)
-    # @param key [String] the key id (JWT `kid` header, PASETO `kid` footer, or SSH `kid` claim)
-    # @param private_key [String] path to the Ed25519 private key file (PKCS#8 PEM for `jwt`/`paseto`, OpenSSH format for `ssh`)
+    # @param kind [String] token kind, one of `"jwt"` or `"paseto"`
+    # @param issuer [String] the `iss` claim
+    # @param key [String] the key id (JWT `kid` header or PASETO `kid` footer)
+    # @param private_key [String] path to a PKCS#8 Ed25519 private key PEM file
     # @param expiration [Integer] token lifetime in seconds (drives `exp`)
     # @raise [ArgumentError] if the kind is not supported
     def initialize(kind:, issuer:, key:, private_key:, expiration:)
@@ -57,13 +57,12 @@ module Nonnative
     # The optional time claims default to the current time (and the constructor `expiration`), so
     # omitting them reproduces the token's normal claims. Supply them to mint tokens with specific
     # time claims for negative auth tests, such as a not-yet-valid (future `not_before`) or
-    # clock-skewed token. Times are absolute; the `ssh` kind has no `nbf` claim and rejects
-    # `not_before`.
+    # clock-skewed token. Times are absolute.
     #
     # @param aud [String] the `aud` claim
     # @param sub [String] the `sub` claim
     # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
-    # @param not_before [Time, nil] overrides the `nbf` claim (default: `issued_at`); unsupported by `ssh`
+    # @param not_before [Time, nil] overrides the `nbf` claim (default: `issued_at`)
     # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
     # @return [String] the signed token
     def generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil)

data/lib/nonnative/version.rb

@@ -4,5 +4,5 @@ module Nonnative
   # The current gem version.
   #
   # @return [String]
-  VERSION = '3.43.0'
+  VERSION = '3.44.0'
 end

data/lib/nonnative.rb

@@ -68,10 +68,9 @@ require 'rspec/wait'
 require 'puma'
 require 'puma/server'
 
-# jwt-eddsa (with the ed25519 gem) and ssh_data are pure Ruby and need no system library, so they load
-# here. PASETO's rbnacl needs system libsodium, so Nonnative::PasetoToken requires it lazily instead.
+# jwt-eddsa (with the ed25519 gem) is pure Ruby and needs no system library, so it loads here.
+# PASETO's rbnacl needs system libsodium, so Nonnative::PasetoToken requires it lazily instead.
 require 'jwt/eddsa'
-require 'ssh_data'
 
 require 'nonnative/version'
 require 'nonnative/error'
@@ -126,7 +125,6 @@ require 'nonnative/header'
 require 'nonnative/ed25519_key'
 require 'nonnative/jwt_token'
 require 'nonnative/paseto_token'
-require 'nonnative/ssh_token'
 require 'nonnative/token'
 
 # The main namespace for the gem.
@@ -218,10 +216,10 @@ module Nonnative
     # The signing parameters are passed in directly; this is not coupled to any service's
     # configuration format. The generated token string is ready for {Nonnative::Header.auth_bearer}.
     #
-    # @param kind [String] token kind, one of `"jwt"`, `"paseto"`, or `"ssh"`
-    # @param issuer [String] the `iss` claim (unused by the `ssh` kind)
-    # @param key [String] the key id (JWT `kid` header, PASETO `kid` footer, or SSH `kid` claim)
-    # @param private_key [String] path to the Ed25519 private key file (PKCS#8 PEM for `jwt`/`paseto`, OpenSSH format for `ssh`)
+    # @param kind [String] token kind, one of `"jwt"` or `"paseto"`
+    # @param issuer [String] the `iss` claim
+    # @param key [String] the key id (JWT `kid` header or PASETO `kid` footer)
+    # @param private_key [String] path to a PKCS#8 Ed25519 private key PEM file
     # @param expiration [Integer] token lifetime in seconds (drives `exp`)
     # @return [Nonnative::Token]
     #

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nonnative
 version: !ruby/object:Gem::Version
-  version: 3.43.0
+  version: 3.44.0
 platform: ruby
 authors:
 - Alejandro Falkowski
@@ -363,26 +363,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '5'
-- !ruby/object:Gem::Dependency
-  name: ssh_data
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3'
 description: Starts OS processes, in-process Ruby servers, and proxy-only services
   with TCP readiness checks and fault-injection proxies.
 email:
@@ -441,7 +421,6 @@ files:
 - lib/nonnative/slicer_socket_pair.rb
 - lib/nonnative/socket_pair.rb
 - lib/nonnative/socket_pair_factory.rb
-- lib/nonnative/ssh_token.rb
 - lib/nonnative/start_error.rb
 - lib/nonnative/startup.rb
 - lib/nonnative/stop_error.rb

data/lib/nonnative/ssh_token.rb

@@ -1,69 +0,0 @@
-# frozen_string_literal: true
-
-module Nonnative
-  # Generates go-service style SSH tokens for authenticating against services under test.
-  #
-  # Despite the name this is not an SSH protocol signature: the key is loaded from an OpenSSH-format
-  # Ed25519 private key and used as a raw Ed25519 key, matching go-service's SSH token scheme. The token
-  # is `<base64(claims)>.<base64(signature)>`, where the signature is a raw Ed25519 signature over the
-  # claims JSON. Claims are ver/kid/sub/aud/iat/exp, with `sub == kid == key` and `iat`/`exp` in Unix
-  # nanoseconds. `issuer` and `sub` are accepted for a uniform interface with the other kinds but unused:
-  # SSH tokens have no issuer, and the subject is always the key id.
-  #
-  # @example
-  #   ssh = Nonnative::SshToken.new(key: 'key-1', private_key: 'config/id_ed25519', expiration: 3600)
-  #   ssh.generate(aud: 'GET /v1/things', sub: 'user-1')
-  #
-  # @see https://github.com/github/ssh_data ssh_data
-  class SshToken
-    # The go-service SSH token format version.
-    TOKEN_VERSION = 'v1'
-
-    # @param key [String] the key id; also used as the subject
-    # @param private_key [String] path to an OpenSSH-format Ed25519 private key file
-    # @param expiration [Integer] token lifetime in seconds (drives `exp`)
-    def initialize(key:, private_key:, expiration:, **)
-      @key = key
-      @private_key = private_key
-      @expiration = expiration
-    end
-
-    # Generates a signed SSH token.
-    #
-    # SSH tokens carry only `iat`/`exp` (in Unix nanoseconds); there is no `nbf` claim, so
-    # `not_before` is rejected.
-    #
-    # @param aud [String] the `aud` claim (for example `"GET /v1/things"` or a gRPC full method)
-    # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
-    # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
-    # @raise [ArgumentError] if `not_before` is given (SSH tokens have no `nbf` claim)
-    # @return [String] the token, `"<base64(claims)>.<base64(signature)>"`
-    def generate(aud:, issued_at: nil, expires_at: nil, not_before: nil, **)
-      raise ArgumentError, "ssh tokens do not support 'not_before' (no nbf claim)" unless not_before.nil?
-
-      iat = nanoseconds(issued_at || Time.now)
-      claims = {
-        ver: TOKEN_VERSION,
-        kid: @key,
-        sub: @key,
-        aud: aud,
-        iat: iat,
-        exp: expires_at ? nanoseconds(expires_at) : iat + (@expiration * 1_000_000_000)
-      }.to_json
-
-      signature = Ed25519::SigningKey.new(seed).sign(claims)
-
-      "#{Base64.strict_encode64(claims)}.#{Base64.strict_encode64(signature)}"
-    end
-
-    private
-
-    def nanoseconds(time)
-      (time.to_i * 1_000_000_000) + time.nsec
-    end
-
-    def seed
-      SSHData::PrivateKey.parse_openssh(File.read(@private_key)).first.sk[0, 32]
-    end
-  end
-end