From 2578c63036e8df95cc63a25618be126f0d2e2c81 Mon Sep 17 00:00:00 2001 From: ilya-korotya Date: Thu, 23 Oct 2025 20:23:37 +0200 Subject: [PATCH 1/2] update jwx lib to v3.10.12 --- Makefile | 2 +- go.mod | 16 ++- go.sum | 32 +++-- packers/providers/jwe/jwe.go | 55 +++++++- packers/providers/jwe/jwe_test.go | 213 ++++++++++++++++++++++++++++++ 5 files changed, 293 insertions(+), 25 deletions(-) create mode 100644 packers/providers/jwe/jwe_test.go diff --git a/Makefile b/Makefile index 7a9ab3d..7929385 100644 --- a/Makefile +++ b/Makefile @@ -2,4 +2,4 @@ lint: golangci-lint --config .golangci.yml run #Unit tests test: - go test -v -race -timeout=60s -count=1 ./... + go test -tags jwx_es256k -v -race -timeout=60s -count=1 ./... diff --git a/go.mod b/go.mod index e6202d5..20eaae8 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/iden3/go-rapidsnark/types v0.0.3 github.com/iden3/go-schema-processor/v2 v2.6.3 github.com/iden3/jose-primitives v0.0.5 - github.com/lestrrat-go/jwx/v3 v3.0.10 + github.com/lestrrat-go/jwx/v3 v3.0.12 github.com/mr-tron/base58 v1.2.0 github.com/pkg/errors v0.9.1 github.com/stretchr/testify v1.11.1 @@ -47,15 +47,17 @@ require ( github.com/iden3/go-rapidsnark/witness/wazero v0.0.0-20230524142950-0986cf057d4e // indirect github.com/iden3/merkletree-proof v1.0.1 // indirect github.com/lestrrat-go/blackmagic v1.0.4 // indirect + github.com/lestrrat-go/dsig v1.0.0 // indirect + github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect github.com/lestrrat-go/httpcc v1.0.1 // indirect - github.com/lestrrat-go/httprc/v3 v3.0.0 // indirect + github.com/lestrrat-go/httprc/v3 v3.0.1 // indirect github.com/lestrrat-go/option v1.0.1 // indirect github.com/lestrrat-go/option/v2 v2.0.0 // indirect github.com/piprate/json-gold v0.5.1-0.20241210232033-19254b3ec65b // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/pquerna/cachecontrol v0.2.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect - github.com/segmentio/asm v1.2.0 // indirect + github.com/segmentio/asm v1.2.1 // indirect github.com/shirou/gopsutil v3.21.11+incompatible // indirect github.com/supranational/blst v0.3.16-0.20250831170142-f48500c1fdbe // indirect github.com/tetratelabs/wazero v1.1.0 // indirect @@ -63,10 +65,10 @@ require ( github.com/tklauser/numcpus v0.10.0 // indirect github.com/valyala/fastjson v1.6.4 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect - golang.org/x/crypto v0.42.0 // indirect - golang.org/x/net v0.44.0 // indirect + golang.org/x/crypto v0.43.0 // indirect + golang.org/x/net v0.45.0 // indirect golang.org/x/sync v0.17.0 // indirect - golang.org/x/sys v0.36.0 // indirect - golang.org/x/text v0.29.0 // indirect + golang.org/x/sys v0.37.0 // indirect + golang.org/x/text v0.30.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 1bd788d..39c62ef 100644 --- a/go.sum +++ b/go.sum @@ -158,12 +158,16 @@ github.com/leanovate/gopter v0.2.11 h1:vRjThO1EKPb/1NsDXuDrzldR28RLkBflWYcU9CvzW github.com/leanovate/gopter v0.2.11/go.mod h1:aK3tzZP/C+p1m3SPRE4SYZFGP7jjkuSI4f7Xvpt0S9c= github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA= github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= +github.com/lestrrat-go/dsig v1.0.0 h1:OE09s2r9Z81kxzJYRn07TFM9XA4akrUdoMwr0L8xj38= +github.com/lestrrat-go/dsig v1.0.0/go.mod h1:dEgoOYYEJvW6XGbLasr8TFcAxoWrKlbQvmJgCR0qkDo= +github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7gcrVVMFPOzY= +github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU= github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE= github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E= -github.com/lestrrat-go/httprc/v3 v3.0.0 h1:nZUx/zFg5uc2rhlu1L1DidGr5Sj02JbXvGSpnY4LMrc= -github.com/lestrrat-go/httprc/v3 v3.0.0/go.mod h1:k2U1QIiyVqAKtkffbg+cUmsyiPGQsb9aAfNQiNFuQ9Q= -github.com/lestrrat-go/jwx/v3 v3.0.10 h1:XuoCBhZBncRIjMQ32HdEc76rH0xK/Qv2wq5TBouYJDw= -github.com/lestrrat-go/jwx/v3 v3.0.10/go.mod h1:kNMedLgTpHvPJkK5EMVa1JFz+UVyY2dMmZKu3qjl/Pk= +github.com/lestrrat-go/httprc/v3 v3.0.1 h1:3n7Es68YYGZb2Jf+k//llA4FTZMl3yCwIjFIk4ubevI= +github.com/lestrrat-go/httprc/v3 v3.0.1/go.mod h1:2uAvmbXE4Xq8kAUjVrZOq1tZVYYYs5iP62Cmtru00xk= +github.com/lestrrat-go/jwx/v3 v3.0.12 h1:p25r68Y4KrbBdYjIsQweYxq794CtGCzcrc5dGzJIRjg= +github.com/lestrrat-go/jwx/v3 v3.0.12/go.mod h1:HiUSaNmMLXgZ08OmGBaPVvoZQgJVOQphSrGr5zMamS8= github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU= github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I= github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss= @@ -224,8 +228,8 @@ github.com/rs/cors v1.7.0 h1:+88SsELBHx5r+hZ8TCkggzSstaWNbDvThkVK8H6f9ik= github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys= -github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= +github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0= +github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI= github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -251,20 +255,20 @@ github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGC github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM= github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0= github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= -golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI= -golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8= +golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04= +golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0= golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU= golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk= -golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I= -golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= +golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM= +golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= -golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk= -golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4= +golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= +golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k= +golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM= golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY= golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg= diff --git a/packers/providers/jwe/jwe.go b/packers/providers/jwe/jwe.go index 2784c32..446d104 100644 --- a/packers/providers/jwe/jwe.go +++ b/packers/providers/jwe/jwe.go @@ -112,6 +112,7 @@ func Encrypt(payload []byte, recipients []jwk.Key, opts ...EncryptOption) ([]byt jwe.WithJSON(), jwe.WithContentEncryption(cea), jwe.WithProtectedHeaders(headers), + jwe.WithLegacyHeaderMerging(false), }, withKeys...) ret, err := jwe.Encrypt(payload, jweOpts...) @@ -128,7 +129,12 @@ type KeyResolutionFunc func(keyID string) (key interface{}, err error) // Decrypt decrypts the JWE envelope using the provided key resolution function func Decrypt(envelope []byte, fn KeyResolutionFunc) ([]byte, error) { customKeyProvider := func(ctx context.Context, sink jwe.KeySink, r jwe.Recipient, msg *jwe.Message) error { - alg, ok := r.Headers().Algorithm() + mergedHeaders, err := mergeHeaders(msg.ProtectedHeaders(), msg.UnprotectedHeaders(), r.Headers()) + if err != nil { + return fmt.Errorf("failed to merge JWE headers: %w", err) + } + + alg, ok := mergedHeaders.Algorithm() if !ok || alg.String() == "" { return fmt.Errorf("recipient has no algorithm") } @@ -136,7 +142,7 @@ func Decrypt(envelope []byte, fn KeyResolutionFunc) ([]byte, error) { return fmt.Errorf("unsupported key encryption algorithm: %s", alg.String()) } - enc, ok := msg.ProtectedHeaders().ContentEncryption() + enc, ok := mergedHeaders.ContentEncryption() if !ok || enc.String() == "" { return fmt.Errorf("message has no content encryption algorithm") } @@ -144,7 +150,7 @@ func Decrypt(envelope []byte, fn KeyResolutionFunc) ([]byte, error) { return fmt.Errorf("unsupported content encryption algorithm: %s", enc.String()) } - kid, ok := r.Headers().KeyID() + kid, ok := mergedHeaders.KeyID() if !ok || kid == "" { return fmt.Errorf("recipient has no key ID") } @@ -162,3 +168,46 @@ func Decrypt(envelope []byte, fn KeyResolutionFunc) ([]byte, error) { } return payload, nil } + +func mergeHeaders(protected, unprotected, perRecipient jwe.Headers) (jwe.Headers, error) { + var allKeys []string + if protected != nil { + allKeys = append(allKeys, protected.Keys()...) + } + if unprotected != nil { + allKeys = append(allKeys, unprotected.Keys()...) + } + if perRecipient != nil { + allKeys = append(allKeys, perRecipient.Keys()...) + } + + seen := make(map[string]struct{}) + for _, key := range allKeys { + if _, ok := seen[key]; ok { + return nil, errors.Errorf("duplicate header key found: %s", key) + } + seen[key] = struct{}{} + } + + // Merge headers (no duplicates, so safe to merge) + result := jwe.NewHeaders() + if protected != nil { + result = protected + } + if unprotected != nil { + var err error + result, err = result.Merge(unprotected) + if err != nil { + return nil, errors.Wrap(err, "failed to merge unprotected headers") + } + } + if perRecipient != nil { + var err error + result, err = result.Merge(perRecipient) + if err != nil { + return nil, errors.Wrap(err, "failed to merge per-recipient headers") + } + } + + return result, nil +} diff --git a/packers/providers/jwe/jwe_test.go b/packers/providers/jwe/jwe_test.go new file mode 100644 index 0000000..dfa0b0d --- /dev/null +++ b/packers/providers/jwe/jwe_test.go @@ -0,0 +1,213 @@ +package jwe + +import ( + "testing" + + "github.com/lestrrat-go/jwx/v3/jwa" + "github.com/lestrrat-go/jwx/v3/jwe" + "github.com/stretchr/testify/require" +) + +func TestMergeHeaders(t *testing.T) { + tests := []struct { + name string + protected jwe.Headers + unprotected jwe.Headers + perRecipient jwe.Headers + expectedHeaders jwe.Headers + }{ + { + name: "all nil headers", + protected: nil, + unprotected: nil, + perRecipient: nil, + expectedHeaders: jwe.NewHeaders(), + }, + { + name: "protected headers only", + protected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + require.NoError(t, h.Set(jwe.ContentEncryptionKey, jwa.A256GCM())) + return h + }(), + expectedHeaders: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + require.NoError(t, h.Set(jwe.ContentEncryptionKey, jwa.A256GCM())) + return h + }(), + }, + { + name: "unprotected headers only", + unprotected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.KeyIDKey, "test-key-id")) + return h + }(), + expectedHeaders: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.KeyIDKey, "test-key-id")) + return h + }(), + }, + { + name: "per-recipient headers only", + perRecipient: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.ECDH_ES_A256KW())) + return h + }(), + expectedHeaders: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.ECDH_ES_A256KW())) + return h + }(), + }, + { + name: "merge all three header types without duplicates", + protected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.ContentEncryptionKey, jwa.A256GCM())) + return h + }(), + unprotected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.KeyIDKey, "test-key-id")) + return h + }(), + perRecipient: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + return h + }(), + expectedHeaders: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.ContentEncryptionKey, jwa.A256GCM())) + require.NoError(t, h.Set(jwe.KeyIDKey, "test-key-id")) + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + return h + }(), + }, + { + name: "empty headers objects", + protected: jwe.NewHeaders(), + unprotected: jwe.NewHeaders(), + perRecipient: jwe.NewHeaders(), + expectedHeaders: jwe.NewHeaders(), + }, + { + name: "custom header fields", + protected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set("custom1", "value1")) + return h + }(), + unprotected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set("custom2", "value2")) + return h + }(), + perRecipient: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set("custom3", "value3")) + return h + }(), + expectedHeaders: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set("custom1", "value1")) + require.NoError(t, h.Set("custom2", "value2")) + require.NoError(t, h.Set("custom3", "value3")) + return h + }(), + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result, err := mergeHeaders(tt.protected, tt.unprotected, tt.perRecipient) + require.NoError(t, err) + require.Equal(t, tt.expectedHeaders, result) + }) + } +} + +func TestMergeHeaders_Errors(t *testing.T) { + tests := []struct { + name string + protected jwe.Headers + unprotected jwe.Headers + perRecipient jwe.Headers + expectedErr string + }{ + { + name: "duplicate key in protected and unprotected", + protected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + return h + }(), + unprotected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.ECDH_ES_A256KW())) + return h + }(), + expectedErr: "duplicate header key found: alg", + }, + { + name: "duplicate key in protected and per-recipient", + protected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + return h + }(), + perRecipient: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.ECDH_ES_A256KW())) + return h + }(), + expectedErr: "duplicate header key found: alg", + }, + { + name: "duplicate key in unprotected and per-recipient", + unprotected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.RSA_OAEP_256())) + return h + }(), + perRecipient: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.AlgorithmKey, jwa.ECDH_ES_A256KW())) + return h + }(), + expectedErr: "duplicate header key found: alg", + }, + { + name: "deuplicate between all three headers", + protected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.TypeKey, "type-1")) + return h + }(), + unprotected: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.TypeKey, "type-2")) + return h + }(), + perRecipient: func() jwe.Headers { + h := jwe.NewHeaders() + require.NoError(t, h.Set(jwe.TypeKey, "type-3")) + return h + }(), + expectedErr: "duplicate header key found: typ", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, err := mergeHeaders(tt.protected, tt.unprotected, tt.perRecipient) + require.Error(t, err) + require.Contains(t, err.Error(), tt.expectedErr) + }) + } +} From 57bfc092c02b0fbd05cef7384a32dceba9e7853a Mon Sep 17 00:00:00 2001 From: ilya-korotya Date: Fri, 24 Oct 2025 13:29:33 +0200 Subject: [PATCH 2/2] fix comments --- .github/workflows/ci-test.yaml | 2 +- packers/providers/jwe/jwe.go | 4 +++- packers/providers/jwe/jwe_test.go | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-test.yaml b/.github/workflows/ci-test.yaml index b4412f2..2355a90 100644 --- a/.github/workflows/ci-test.yaml +++ b/.github/workflows/ci-test.yaml @@ -30,4 +30,4 @@ jobs: - name: Update go modules run: go mod tidy - name: Unit Tests - run: go test -v -race -timeout=60s ./... + run: go test -v -race -timeout=60s -tags jwx_es256k ./... diff --git a/packers/providers/jwe/jwe.go b/packers/providers/jwe/jwe.go index 446d104..cc46fe2 100644 --- a/packers/providers/jwe/jwe.go +++ b/packers/providers/jwe/jwe.go @@ -192,7 +192,9 @@ func mergeHeaders(protected, unprotected, perRecipient jwe.Headers) (jwe.Headers // Merge headers (no duplicates, so safe to merge) result := jwe.NewHeaders() if protected != nil { - result = protected + if err := protected.Copy(result); err != nil { + return nil, errors.Wrap(err, "failed to merge protected headers") + } } if unprotected != nil { var err error diff --git a/packers/providers/jwe/jwe_test.go b/packers/providers/jwe/jwe_test.go index dfa0b0d..c47ee83 100644 --- a/packers/providers/jwe/jwe_test.go +++ b/packers/providers/jwe/jwe_test.go @@ -183,7 +183,7 @@ func TestMergeHeaders_Errors(t *testing.T) { expectedErr: "duplicate header key found: alg", }, { - name: "deuplicate between all three headers", + name: "duplicate between all three headers", protected: func() jwe.Headers { h := jwe.NewHeaders() require.NoError(t, h.Set(jwe.TypeKey, "type-1"))