Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-joserfc for openSUSE:Factory checked in at 2026-07-21 23:09:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-joserfc (Old) and /work/SRC/openSUSE:Factory/.python-joserfc.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-joserfc" Tue Jul 21 23:09:08 2026 rev:13 rq:1366811 version:1.7.4 Changes: -------- --- /work/SRC/openSUSE:Factory/python-joserfc/python-joserfc.changes 2026-07-15 17:01:34.955069565 +0200 +++ /work/SRC/openSUSE:Factory/.python-joserfc.new.24530/python-joserfc.changes 2026-07-21 23:09:17.080008677 +0200 @@ -1,0 +2,8 @@ +Mon Jul 20 16:15:11 UTC 2026 - Dirk Müller <[email protected]> + +- update to 1.7.4: + * Reject JWS general JSON serialization when signatures is + empty. + * Raises DecodeError when encrypted_key is None in JWE. + +------------------------------------------------------------------- Old: ---- joserfc-1.7.3.tar.gz New: ---- joserfc-1.7.4.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-joserfc.spec ++++++ --- /var/tmp/diff_new_pack.B42nRe/_old 2026-07-21 23:09:19.128078699 +0200 +++ /var/tmp/diff_new_pack.B42nRe/_new 2026-07-21 23:09:19.148079383 +0200 @@ -18,7 +18,7 @@ %{?sle15_python_module_pythons} Name: python-joserfc -Version: 1.7.3 +Version: 1.7.4 Release: 0 Summary: The ultimate Python library for JOSE RFCs License: BSD-3-Clause ++++++ joserfc-1.7.3.tar.gz -> joserfc-1.7.4.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/PKG-INFO new/joserfc-1.7.4/PKG-INFO --- old/joserfc-1.7.3/PKG-INFO 2026-07-08 14:41:20.949653900 +0200 +++ new/joserfc-1.7.4/PKG-INFO 2026-07-19 17:42:30.915866400 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: joserfc -Version: 1.7.3 +Version: 1.7.4 Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT Author-email: Hsiaoming Yang <[email protected]> License: BSD-3-Clause diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/docs/changelog.rst new/joserfc-1.7.4/docs/changelog.rst --- old/joserfc-1.7.3/docs/changelog.rst 2026-07-08 14:41:16.000000000 +0200 +++ new/joserfc-1.7.4/docs/changelog.rst 2026-07-19 17:42:25.000000000 +0200 @@ -12,6 +12,14 @@ .. module:: joserfc :noindex: +1.7.4 +----- + +**Released on July 13, 2026** + +- Reject JWS general JSON serialization when signatures is empty. +- Raises ``DecodeError`` when encrypted_key is None in JWE. + 1.7.3 ----- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/src/joserfc/__init__.py new/joserfc-1.7.4/src/joserfc/__init__.py --- old/joserfc-1.7.3/src/joserfc/__init__.py 2026-07-08 14:41:16.000000000 +0200 +++ new/joserfc-1.7.4/src/joserfc/__init__.py 2026-07-19 17:42:25.000000000 +0200 @@ -1,4 +1,4 @@ -__version__ = "1.7.3" +__version__ = "1.7.4" __homepage__ = "https://jose.authlib.org/en/"; __author__ = "Hsiaoming Yang <[email protected]>" __license__ = "BSD-3-Clause" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/src/joserfc/_rfc7515/json.py new/joserfc-1.7.4/src/joserfc/_rfc7515/json.py --- old/joserfc-1.7.3/src/joserfc/_rfc7515/json.py 2026-07-08 14:41:16.000000000 +0200 +++ new/joserfc-1.7.4/src/joserfc/_rfc7515/json.py 2026-07-19 17:42:25.000000000 +0200 @@ -115,6 +115,9 @@ def verify_general_json(obj: GeneralJSONSignature, registry: JWSRegistry, find_key: FindKey) -> bool: payload_segment = obj.segments["payload"] + if not obj.signatures: + return False + for index, signature in enumerate(obj.signatures): member = obj.members[index] if not verify_signature(member, signature, payload_segment, registry, find_key): diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/src/joserfc/_rfc7516/message.py new/joserfc-1.7.4/src/joserfc/_rfc7516/message.py --- old/joserfc-1.7.3/src/joserfc/_rfc7516/message.py 2026-07-08 14:41:16.000000000 +0200 +++ new/joserfc-1.7.4/src/joserfc/_rfc7516/message.py 2026-07-19 17:42:25.000000000 +0200 @@ -243,7 +243,8 @@ # 8. When Key Agreement with Key Wrapping is employed, the agreed upon key # will be used to decrypt the JWE Encrypted Key. - assert recipient.encrypted_key is not None + if recipient.encrypted_key is None: # pragma: no cover + raise DecodeError("Invalid encrypted key") cek = alg.unwrap_cek_with_auk(recipient.encrypted_key, agreed_upon_key) else: # 9. When Key Wrapping, Key Encryption, or Key Agreement with Key @@ -256,5 +257,7 @@ # to decrypt one of the per-recipient JWE Encrypted Key values to # obtain the CEK value. assert isinstance(alg, (JWEKeyWrapping, JWEKeyEncryption)) + if recipient.encrypted_key is None: + raise DecodeError("Invalid encrypted key") cek = alg.decrypt_cek(recipient) return cek diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/src/joserfc.egg-info/PKG-INFO new/joserfc-1.7.4/src/joserfc.egg-info/PKG-INFO --- old/joserfc-1.7.3/src/joserfc.egg-info/PKG-INFO 2026-07-08 14:41:20.000000000 +0200 +++ new/joserfc-1.7.4/src/joserfc.egg-info/PKG-INFO 2026-07-19 17:42:30.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: joserfc -Version: 1.7.3 +Version: 1.7.4 Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT Author-email: Hsiaoming Yang <[email protected]> License: BSD-3-Clause diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/tests/jwe/test_json.py new/joserfc-1.7.4/tests/jwe/test_json.py --- old/joserfc-1.7.3/tests/jwe/test_json.py 2026-07-08 14:41:16.000000000 +0200 +++ new/joserfc-1.7.4/tests/jwe/test_json.py 2026-07-19 17:42:25.000000000 +0200 @@ -73,6 +73,20 @@ registry=registry, ) + def test_general_json_without_recipients(self): + obj = GeneralJSONEncryption({"enc": "A128CBC-HS256"}, b"i") + obj.add_recipient({"alg": "RSA-OAEP"}, self.rsa_key) + value = jwe.encrypt_json(obj, None) + value["recipients"] = [] + self.assertRaises(DecodeError, jwe.decrypt_json, value, self.rsa_key) + + def test_general_json_without_encrypted_key(self): + obj = GeneralJSONEncryption({"enc": "A128CBC-HS256"}, b"i") + obj.add_recipient({"alg": "RSA-OAEP"}, self.rsa_key) + value = jwe.encrypt_json(obj, None) + del value["recipients"][0]["encrypted_key"] + self.assertRaises(DecodeError, jwe.decrypt_json, value, self.rsa_key) + def test_flattened_encryption(self): key = OctKey.generate_key(128) protected = {"enc": "A128CBC-HS256"} @@ -88,3 +102,11 @@ value = jwe.encrypt_json(obj0, None) obj3 = jwe.decrypt_json(value, key) self.assertEqual(obj3.plaintext, plaintext) + + def test_flattened_json_without_encrypted_key(self): + key = OctKey.generate_key(128) + obj = FlattenedJSONEncryption({"enc": "A128CBC-HS256"}, b"hello world") + obj.add_recipient({"alg": "A128KW"}, key) + value = jwe.encrypt_json(obj, None) + del value["encrypted_key"] + self.assertRaises(DecodeError, jwe.decrypt_json, value, key) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.3/tests/jws/test_json.py new/joserfc-1.7.4/tests/jws/test_json.py --- old/joserfc-1.7.3/tests/jws/test_json.py 2026-07-08 14:41:16.000000000 +0200 +++ new/joserfc-1.7.4/tests/jws/test_json.py 2026-07-19 17:42:25.000000000 +0200 @@ -106,6 +106,13 @@ value = serialize_json([member], b"hello", key1) self.assertRaises(BadSignatureError, deserialize_json, value, key2) + def test_general_json_with_empty_signatures(self): + data: GeneralJSONSerialization = { + "payload": "eyJ1c2VyIjoiYWRtaW4ifQ", + "signatures": [], + } + self.assertRaises(BadSignatureError, deserialize_json, data, self.key) + def test_with_public_header(self): key: RSAKey = load_key("rsa-openssl-private.pem") member: HeaderDict = {"header": {"alg": "RS256", "kid": "abc"}}
