libjwt: update to 3.6.1 - #30331
Conversation
3.4.0: complete JWE (JSON Web Encryption) implementation with AES-GCM and AES-CBC-HMAC content encryption, key management algorithms (dir, AES Key Wrap, RSA-OAEP, ECDH-ES), Compact/JSON serialisations across OpenSSL, MbedTLS and GnuTLS backends. PEM/DER<->JWK conversion made public API; added jti callback and crit header handling. Security hardening: strict base64url enforcement, tighter claim validation, IV/ECDSA/OKP checks, bounded-buffer JWKS streaming over libcurl. 3.5.0: post-quantum ML-DSA (FIPS 204/RFC 9964), new ML-DSA-44/65/87 algorithms and AKP JWK key type (OpenSSL >=3.5 / GnuTLS >=3.8.10). OpenSSL now optional; GnuTLS-only or MbedTLS-only builds supported; MbedTLS backend migrated to the PSA Crypto API. GnuTLS minimum version raised to 3.8.4; runtime gating for two OKP defects. 3.6.0: JWS JSON Serialization with multiple signatures (RFC 7515 S7.2), unencoded/detached payloads (RFC 7797), JWK thumbprints (RFC 7638/9278), confirmation/proof-of-possession (RFC 7800). Cached remote JWKS with TTL/Cache-Control/ETag refresh and SSRF guards; jwks_generate(); X.509 JWK parameters (x5c, x5t/x5t#S256). Application profiles for at+jwt, DPoP, VAPID, PASSporT, OpenID4VCI, mTLS, JAdES. 3.6.1: build portability fix for the jwks-cache test server on newer glibc (-Werror/warn_unused_result). Packaging: upstream's SONAME moved from libjwt.so.0 to libjwt.so.14 somewhere in the 3.4-3.6 range (stable across it per upstream's ABI notes). Bumped ABI_VERSION accordingly (renames the package to libjwt14) and dropped the install rule's now-stale "$(LN) libjwt.so.0 .../libjwt.so", which would have overwritten the correct libjwt.so -> libjwt.so.14 symlink already produced by the preceding $(CP) with a dangling one. Signed-off-by: Daniel Golle <[email protected]>
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Nothing here blocks a merge. Checked against the upstream v3.6.1 tree: the tag exists, SOVERSION is 14 (libjwt.so.14.4.1), so ABI_VERSION:=14 is correct, and dropping the $(LN) is right — $(CP) (cp -fpR) copies the install tree's symlinks as symlinks, so libjwt.so -> libjwt.so.14 -> libjwt.so.14.4.1 comes out intact. Dependencies still look complete: with WITH_GNUTLS=OFF/WITH_MBEDTLS=OFF (still needed — 3.6.1 auto-detects GnuTLS when the option is left undefined) the only pkg_check_modules(... REQUIRED) that fire are jansson >= 2.0 and openssl >= 3.0.0, both already in DEPENDS, and PKG_RELEASE is correctly at 1 for a version bump.
Commit checks
- e28c371 "libjwt: update to 3.6.1" — the packaging paragraph is inaccurate: upstream's SONAME did not move "somewhere in the 3.4-3.6 range", it has been
libjwt.so.14since v3.0.0 (v3.3.3 already builtlibjwt.so.14.2.7). That makes theABI_VERSION/$(LN)change a fix for a bug that already exists in master rather than a consequence of this update. Details inline.
Generated by Claude Code
| URL:=https://github.com/benmcollins/libjwt | ||
| DEPENDS:=+libopenssl +jansson | ||
| ABI_VERSION:=0 | ||
| ABI_VERSION:=14 |
There was a problem hiding this comment.
ABI_VERSION:=14 is the right value, but the rationale in the commit message and PR body doesn't hold: the SONAME did not move during 3.4-3.6. v3.3.3 already carried set(LIBJWT_SO_CRA 16 7 2), and SOVERSION = current - age = 16 - 2 = 14, i.e. libjwt.so.14.2.7; the SONAME-history comment on the following lines records the last bump as v3.0.0 2 => 14. v3.6.1 is 18 1 4 → libjwt.so.14.4.1, same SONAME 14.
So ABI_VERSION:=0 and the $(LN) libjwt.so.0 were already stale before this update — master today ships a dangling /usr/lib/libjwt.so -> libjwt.so.0, because $(CP) libjwt.so* copies the correct libjwt.so -> libjwt.so.14 link and the $(LN) then clobbers it. Both hunks are correct as written; only the "moved somewhere in the 3.4-3.6 range" explanation needs fixing. Since the ABI/symlink fix is independent of the version bump, it would also stand on its own as a separate commit.
Generated by Claude Code
| @@ -28,7 +28,7 @@ define Package/libjwt | |||
| TITLE:=libjwt | |||
| URL:=https://github.com/benmcollins/libjwt | |||
| DEPENDS:=+libopenssl +jansson | |||
There was a problem hiding this comment.
nit: two of the headline features named in the commit body aren't actually built here. Upstream gates them behind CMake options that default to OFF — WITH_LIBCURL (cached/remote JWKS) and WITH_ML_DSA (ML-DSA, also still marked experimental) — and CMAKE_OPTIONS at Makefile:15-19 sets neither, so the package gets JWE and the JWS-JSON work but not those two. Intentional? If so it's only the PR/commit wording that oversells; if you do want ML-DSA, OpenSSL in main is 3.5.7 and satisfies the >= 3.5 check. And should WITH_LIBCURL=ON ever be added, +libcurl has to be added to this DEPENDS line too, since libcurl is linked PUBLIC into libjwt.
Generated by Claude Code
2 participants
📦 Package Details
Maintainer: @dangowrt
(You can find this by checking the history of the package
Makefile.)Description:
From 3.3.3, via 3.4.0/3.5.0/3.6.0. Adds a complete JWE implementation, post-quantum ML-DSA signatures, JWS JSON Serialization with multiple signatures, unencoded/detached payloads, JWK thumbprints, confirmation/proof-of-possession, cached remote JWKS with SSRF guards, and application profiles for at+jwt/DPoP/VAPID/PASSporT/OpenID4VCI/mTLS/JAdES.
Packaging fix: upstream's SONAME moved from
libjwt.so.0tolibjwt.so.14somewhere in the 3.4-3.6 range. BumpedABI_VERSIONfrom 0 to 14 (renames the built package tolibjwt14) and dropped the install rule's stale$(LN) libjwt.so.0 .../libjwt.so, which would have overwritten the correct symlink already produced by $(CP) with a dangling one. Verified against the built tree thatlibjwt.so -> libjwt.so.14 -> libjwt.so.14.4.1is now correct.🧪 Run Testing Details
✅ Formalities
If your PR contains a patch:
git am(e.g., subject line, commit description, etc.)
We must try to upstream patches to reduce maintenance burden.