)]}' { "commit": "39fef0d3c70b7e9a096437d519d765ebd1a6e5ba", "tree": "64152267a8345208a52841f1169e0e8de0c9d3cf", "parents": [ "ac01b6ed021ae8752dcf957af0edd6749dfe4488" ], "author": { "name": "Ben Collins", "email": "bcollins@libjwt.io", "time": "Mon Jun 15 13:52:41 2026 -0400" }, "committer": { "name": "Ben Collins", "email": "bcollins@libjwt.io", "time": "Mon Jun 15 13:52:41 2026 -0400" }, "message": "Make OpenSSL an optional crypto backend (closes #297)\n\nOpenSSL was mandatory; it is now one of three interchangeable backends.\nlibjwt builds and passes its test suite with any non-empty subset of\n{OpenSSL, GnuTLS, MbedTLS} (default WITH_OPENSSL\u003dON).\n\nCore decoupling:\n- Replace the OPENSSL_cleanse-based jwt_scrub_and_free (used in ~60 sites\n across the core and every backend) with a portable jwt_cleanse; guard the\n \u003copenssl/crypto.h\u003e include under HAVE_OPENSSL and include \u003climits.h\u003e\n explicitly so non-OpenSSL builds need no OpenSSL header.\n\nNative key2jwk:\n- Split openssl/jwk-export.c into a crypto-free common jwk-export.c (the new\n jwk_export_t struct + key2jwk_params ops member, JWK assembly, base64url\n encoding, kid via the backend RNG, and the HMAC fallback) plus native\n per-backend extractors for OpenSSL, GnuTLS, and MbedTLS. Drops the\n cross-backend dependency on openssl_key2jwk.\n\nRSA-OAEP (SHA-1):\n- The GnuTLS -\u003e OpenSSL fallback for plain RSA-OAEP (which GnuTLS/nettle\n cannot perform), is now gated on HAVE_OPENSSL; without OpenSSL it fails\n cleanly instead of referencing an undefined symbol.\n\nBuild:\n- Add WITH_OPENSSL (default ON); move OpenSSL detection, sources, links, and\n HAVE_CRYPTO inside if(WITH_OPENSSL); stop linking OpenSSL into the tools;\n make the pkg-config Requires conditional; require GnuTLS \u003e\u003d 3.8.4 for an\n OpenSSL-less GnuTLS build (older GnuTLS has no native JWK/JWE path).\n\nCI:\n- Add a build-linux-combos matrix exercising all seven backend combinations\n (build + full test suite) in a debian:forky container.\n\nTests cover each backend\u0027s native key2jwk, with skips for genuinely\nunsupported cases (MbedTLS+EdDSA/RSA-PSS, native GnuTLS+secp256k1); the CLI\ngolden-JWKS test skips on backends that cannot convert every key type.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Ben Collins \u003cbcollins@libjwt.io\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "7476f7028bce29edf3b6af33de6d272b0a280e32", "old_mode": 33188, "old_path": ".github/workflows/build-and-test.yml", "new_id": "1f6a0276ca20bc11c8c614ec6803f9ccad90d0d1", "new_mode": 33188, "new_path": ".github/workflows/build-and-test.yml" }, { "type": "modify", "old_id": "f46cd072daf3033c608569ec65f3360d13aee112", "old_mode": 33188, "old_path": "CLAUDE.md", "new_id": "3b61b3acb745fdd7963d5242011d978b2e90adce", "new_mode": 33188, "new_path": "CLAUDE.md" }, { "type": "modify", "old_id": "3b0ec560aa417499638b6b7b8a6a994c2cfbfd6d", "old_mode": 33188, "old_path": "CMakeLists.txt", "new_id": "367bb34397e636d46e1ad06484bb49719edb301a", "new_mode": 33188, "new_path": "CMakeLists.txt" }, { "type": "modify", "old_id": "c196e9b98ce77948e0acb6806d64fb8096ab7d1b", "old_mode": 33188, "old_path": "README.md", "new_id": "4acd8cd74db53cb79f73721806b1256ecc32d8b4", "new_mode": 33188, "new_path": "README.md" }, { "type": "modify", "old_id": "4b095010df952262c9b742592d45451ae9d21720", "old_mode": 33188, "old_path": "libjwt/gnutls/jwe.c", "new_id": "5d1509b9559b8f6460634e57c7117b205811ee5a", "new_mode": 33188, "new_path": "libjwt/gnutls/jwe.c" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "d954ce713b8edfa63439902c23db6bf33c876a63", "new_mode": 33188, "new_path": "libjwt/gnutls/jwk-export.c" }, { "type": "modify", "old_id": "ad96d3c3b49c169920d99cd0029c845f88e326af", "old_mode": 33188, "old_path": "libjwt/gnutls/jwk-parse.c", "new_id": "6405ce57c70cfda468d387959acb97bdd0c1c2e3", "new_mode": 33188, "new_path": "libjwt/gnutls/jwk-parse.c" }, { "type": "modify", "old_id": "ad009bf69018115824a90246748c1d689ec75af7", "old_mode": 33188, "old_path": "libjwt/gnutls/jwt-gnutls.h", "new_id": "668d0ba0e62273e124d4396d049af560e3d5ce6b", "new_mode": 33188, "new_path": "libjwt/gnutls/jwt-gnutls.h" }, { "type": "modify", "old_id": "c0789001f8e36d5bb1d99996ae4facec9c58b46b", "old_mode": 33188, "old_path": "libjwt/gnutls/sign-verify.c", "new_id": "6c32254065f704a731940465c09bd7c168c14595", "new_mode": 33188, "new_path": "libjwt/gnutls/sign-verify.c" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "ad30f228f243055089f2c92c8f02278d1e514f7d", "new_mode": 33188, "new_path": "libjwt/jwk-export.c" }, { "type": "modify", "old_id": "fc7c64d056c9249996411e545a4d735fa56ac3a7", "old_mode": 33188, "old_path": "libjwt/jwks.c", "new_id": "4acf146321a95839e25744ba7ac3cd4b9c45b1ca", "new_mode": 33188, "new_path": "libjwt/jwks.c" }, { "type": "modify", "old_id": "02c90228f9439fa485e50090e2713803c28647ce", "old_mode": 33188, "old_path": "libjwt/jwt-private.h", "new_id": "67b6dd1efbdb0a5dd58cc7a5b763c0ed13c43b1d", "new_mode": 33188, "new_path": "libjwt/jwt-private.h" }, { "type": "modify", "old_id": "86f20436e0f5e612a01d5fe1c13695a049f04507", "old_mode": 33188, "old_path": "libjwt/libjwt.pc.in", "new_id": "06e745a70548c5954d894e17f8906e7fbdeeb29f", "new_mode": 33188, "new_path": "libjwt/libjwt.pc.in" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "8e4e2ff9a9c4053b30485df05f5fadcfbca126c5", "new_mode": 33188, "new_path": "libjwt/mbedtls/jwk-export.c" }, { "type": "modify", "old_id": "4a83939a2bf37b1a80388af6e0a843cdd051e779", "old_mode": 33188, "old_path": "libjwt/mbedtls/jwt-mbedtls.h", "new_id": "788a27856f635a970d7d13b6a28417a6ad2804e8", "new_mode": 33188, "new_path": "libjwt/mbedtls/jwt-mbedtls.h" }, { "type": "modify", "old_id": "e3f2bb8fac74c6d88d7a002ac8f9d0f91b860efa", "old_mode": 33188, "old_path": "libjwt/mbedtls/sign-verify.c", "new_id": "85a5d6b51249189fc5172914f4d7b70509cf4016", "new_mode": 33188, "new_path": "libjwt/mbedtls/sign-verify.c" }, { "type": "modify", "old_id": "34bfcef6907a04cfd2b58881fed5aa15d07427b2", "old_mode": 33188, "old_path": "libjwt/openssl/jwk-export.c", "new_id": "e9f9ca1fb49930eee9fd2ace9e77fc7c105e722c", "new_mode": 33188, "new_path": "libjwt/openssl/jwk-export.c" }, { "type": "modify", "old_id": "aa558315150bce6a23841fe24b61b7fc8e841d91", "old_mode": 33188, "old_path": "libjwt/openssl/jwt-openssl.h", "new_id": "4c6070a025550120e675163bd59544d67026a629", "new_mode": 33188, "new_path": "libjwt/openssl/jwt-openssl.h" }, { "type": "modify", "old_id": "61c6c908e6c526362b9a5ccec1cc5ffb78c6cac2", "old_mode": 33188, "old_path": "libjwt/openssl/sign-verify.c", "new_id": "001886dcd9dbfcd24ff60c91057ffbdd82e598fc", "new_mode": 33188, "new_path": "libjwt/openssl/sign-verify.c" }, { "type": "modify", "old_id": "f9bc2d6642f47a5e7c77e8313285758559c4b9ba", "old_mode": 33188, "old_path": "tests/jwe_rsa.c", "new_id": "d03c1f60eca224a917ab952e7543dece9194f22e", "new_mode": 33188, "new_path": "tests/jwe_rsa.c" }, { "type": "modify", "old_id": "fd8bb1cc87b84c8db0819dbcc938e7fffa3fd544", "old_mode": 33261, "old_path": "tests/jwt-cli.bats", "new_id": "a5c697a70024f362747e35f19cc8bee0da4a10ed", "new_mode": 33261, "new_path": "tests/jwt-cli.bats" }, { "type": "modify", "old_id": "570e8f9b105298a62cc8c30928f2c3896566b8b2", "old_mode": 33188, "old_path": "tests/jwt_checker.c", "new_id": "789a219c5a48b30210ec9c5314eb7bee8752ddc5", "new_mode": 33188, "new_path": "tests/jwt_checker.c" }, { "type": "modify", "old_id": "8e31070e3926e3fc785b965cf1e2be5e4b1bd850", "old_mode": 33188, "old_path": "tests/jwt_jwks_pem.c", "new_id": "0f2235edfdaec749ae7117a8ac93178f60a47eb4", "new_mode": 33188, "new_path": "tests/jwt_jwks_pem.c" } ] }