[maraino]

Summary

Upgrades github.com/go-jose/go-jose from v3.0.5 to v4.1.4. The jose package keeps its function signatures, but v4 changes some behavior that callers depend on, and two aliased types change their API.

Parsing

• ParseSigned, ParseJWS, and ParseEncrypted pass v4 an allowlist containing every algorithm this package supports, so they accept the same algorithms as before.
• v4's jwt.ParseSigned only accepts compact tokens and no longer strips whitespace. ParseSigned keeps the v3 behavior: it strips whitespace and converts a JSON-serialized token with a single signature to compact form. It copies the original base64url segments, because re-encoding the header could change the signed bytes.
• v4 rejects unsupported algorithms when parsing a JWE. Decrypt and guessKeyType now return an error for input that looks like a JWE but fails to parse; before, it was treated as plain data.

Key sizes

• v4 rejects HMAC keys shorter than the hash output, on both sign and verify, and picks the AES variant from the key length.
• GenerateJWK now defaults oct keys to the size the algorithm needs: 48 and 64 bytes for HS384 and HS512, and 16 and 24 bytes for the A128 and A192 key wrap algorithms. It rejects explicit sizes that won't work.
• ValidateJWK applies the same checks to loaded keys, and ErrInvalidKeySize is exported.

Breaking changes

• Builder.CompactSerialize() and FullSerialize() are replaced by Serialize().
• Expected.Audience is replaced by AnyAudience, which matches if any audience is present. v3 required all of them, so a plain rename weakens the check.
• HMAC keys shorter than the hash output no longer sign or verify. That includes HS384 and HS512 keys created with the old 32-byte default.
• ParseSigned rejects JSON-serialized tokens that have an unprotected header or more than one signature.
• Unknown algorithms now fail in ParseSigned and ParseEncrypted instead of in Verify and Decrypt, and some error messages changed. For example, an unsupported crit header now returns ErrUnsupportedCriticalHeader instead of ErrCryptoFailure.

Updates needed downstream:

• certificates/acme/challenge.go:683 and :728 use Expected{Audience: ...}.
• certificates/cas/stepcas/jwk_issuer.go:98 uses CompactSerialize().

Testing

• go test ./jose/... ./kms/azurekms/... passes.

• Ran the original v3 test suite against the new code. The only failures were the expected ones: JSON-serialized JWTs (now handled) and a 7-byte HMAC key.

• Built a probe twice, once against v3 and once against v4, and checked artifacts in both directions:

  • JWTs and JWSs for every signature algorithm, in compact and JSON form.
  • Every JWE combination: 17 key algorithms × 6 content encryptions, in both serializations.
  • Password-encrypted JWKs.

  Everything interoperates apart from the breaking changes listed above, and key thumbprints match.

• Diffed about 90 edge cases between the two versions. The PBES2 iteration limit, the decompression limit, whitespace handling, and x5cInsecure parsing behave the same.

🤖 Generated with Claude Code

[hslatman]

Changes look good. A couple remarks:

• The breaking changes are only called out in the PR (currently). We'll need to ensure that usages get updated appropriately, and we don't control all of them. I believe the Audience -> AnyAudience is the riskiest one to get right for callers.
• It might be nice to pin allowed algorithms as a caller, instead of relying on the hardcoded ones. That would need a new function.
• The README mentions v3. Should become v4, but not a blocker.