GOSE - JOSE and friends for the Go developer

Overview

GOSE is JOSE/JWT/JWK/JWS/JWKS implemented in Go with Helpers, and examples.

It contains implementations of the JOSE suite of types and helpers for many different use cases.

This repository is built with a hardened GitHub Actions pipeline: golangci-lint, govulncheck, CodeQL, dependency review, and an OpenSSF Scorecard rating gate every push, while GitHub native secret scanning and push protection guard every push and pull request. Tagged releases are signed and SLSA3-attested rather than just pushed — see Releases & verification below for what ships and how to check it.

Upgrading from a pre-1.0 release? See CHANGELOG.md for the breaking changes and what's new in v1.0.0.

Part of Eclipse Keypont

gose is part of Eclipse Keypont, alongside crypto11 and pkcs11-go. Keypont — "key" plus the French pont ("bridge") — reflects the project's goal: bridging Go applications to cryptographic keys held in HSMs and other PKCS#11-backed hardware.

Known Issues

• Direct encryption with AEAD mechanisms is not completely following RFC 7516

Mission

• Simple
• Compliant
• Safe
• Efficient
• Extensible

Examples

Examples are provided under the /examples folder to illustrate correct use of this package.

Releases & verification

As a Go library, integrity for go get consumers is already provided by the Go module ecosystem: go.sum pins content hashes and the public checksum database sum.golang.org — a tamper-evident transparency log — is checked on every fetch. You do not need to configure anything for that.

On top of that, each release is independently signed and attested:

• Signed tags. Release tags are GPG/SSH-signed (git tag -s, via make release VERSION=x.y.z). Verify with:

  git verify-tag vX.Y.Z

• Signed source archive + SLSA3 provenance. Pushing a v* tag runs release.yml, which attaches to the GitHub Release a source archive (gose-<tag>.tar.gz), its SHA-256, a keyless cosign signature bundle, and a SLSA3 provenance (*.intoto.jsonl). These serve auditors and OpenSSF Scorecard; go get does not use them. Verify a downloaded archive with:

  # cosign signature (keyless, GitHub OIDC identity):
  cosign verify-blob \
    --bundle gose-vX.Y.Z.tar.gz.cosign.bundle \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-identity-regexp '^https://github.com/eclipse-keypont/gose/.github/workflows/release.yml@refs/tags/vX.Y.Z$' \
    gose-vX.Y.Z.tar.gz
  
  # SLSA provenance:
  slsa-verifier verify-artifact \
    --provenance-path gose-vX.Y.Z.tar.gz.intoto.jsonl \
    --source-uri github.com/eclipse-keypont/gose \
    --source-tag vX.Y.Z \
    gose-vX.Y.Z.tar.gz

Third-party notices

NOTICES.md lists all third-party dependency licenses and is auto-generated via make notices (requires go-licenses).

Vulnerability check

$ govulncheck ./...

Scanning your code and 139 packages across 9 dependent modules for known vulnerabilities...

No vulnerabilities found.