chore: update GWX packages to V3

This change includes:
- go mod tidy
- go fmt
- update tests with new error messages
- code changes for "Change JWT accessors from returning T to returning (T, bool)"
- code changes for "Remove iterators from JWX" and as a result removing Token.PrivateClaims() method.

Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>

Author: anta5010

arc/cmd/common.go

@@ -5,14 +5,14 @@ package cmd
 import (
 	"strings"
 
-	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v3/jwa"
 )
 
 func algList() string {
 	var l []string // nolint: prealloc
 
 	for _, a := range jwa.SignatureAlgorithms() {
-		l = append(l, string(a))
+		l = append(l, a.String())
 	}
 
 	return strings.Join(l, ", ")

arc/cmd/create.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/lestrrat-go/jwx/v2/jwa"
-	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v3/jwa"
+	"github.com/lestrrat-go/jwx/v3/jwk"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 	"github.com/veraison/ear"
@@ -64,7 +64,11 @@ the key in the default key file "skey.json", and save the result to "my-ear.jwt"
 				return fmt.Errorf("parsing signing key from %q: %w", createSKey, err)
 			}
 
-			if arBytes, err = ar.Sign(jwa.KeyAlgorithmFrom(createAlg), sigK); err != nil {
+			alg, err := jwa.KeyAlgorithmFrom(createAlg); if err != nil {
+				return fmt.Errorf("parsing algorithm from %q: %w", createAlg,  err)
+			}
+
+			if arBytes, err = ar.Sign(alg, sigK); err != nil {
 				return fmt.Errorf("signing EAR: %w", err)
 			}
 

arc/cmd/create_test.go

@@ -66,7 +66,7 @@ func Test_CreateCmd_skey_file_bad_format(t *testing.T) {
 	}
 	cmd.SetArgs(args)
 
-	expectedErr := `parsing signing key from "empty-skey.json": failed to unmarshal JSON into key hint: EOF`
+	expectedErr := `parsing signing key from "empty-skey.json": jwk.Parse: failed to probe data: probe: failed to unmarshal data: EOF`
 
 	err := cmd.Execute()
 	assert.EqualError(t, err, expectedErr)
@@ -89,7 +89,7 @@ func Test_CreateCmd_skey_not_ok_for_signing(t *testing.T) {
 	}
 	cmd.SetArgs(args)
 
-	expectedErr := `failed to generate signature for signer #0 (alg=ES256): failed to sign payload: failed to retrieve ecdsa.PrivateKey out of *jwk.ecdsaPublicKey: failed to produce ecdsa.PrivateKey from *jwk.ecdsaPublicKey: argument to AssignIfCompatible() must be compatible with *ecdsa.PublicKey (was *ecdsa.PrivateKey)`
+	expectedErr := `invalid key type *jwk.ecdsaPublicKey. ecdsa.PrivateKey is required: keyconv: failed to produce ecdsa.PrivateKey from *jwk.ecdsaPublicKey`
 
 	err := cmd.Execute()
 	assert.ErrorContains(t, err, expectedErr)
@@ -154,7 +154,7 @@ func Test_CreateCmd_unknown_signing_alg(t *testing.T) {
 	}
 	cmd.SetArgs(args)
 
-	expectedErr := `expected algorithm to be of type jwa.SignatureAlgorithm but got ("XYZ", jwa.InvalidKeyAlgorithm)`
+	expectedErr := `invalid key value: "XYZ": invalid key algorithm`
 
 	err := cmd.Execute()
 	assert.ErrorContains(t, err, expectedErr)

arc/cmd/verify.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/lestrrat-go/jwx/v2/jwa"
-	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v3/jwa"
+	"github.com/lestrrat-go/jwx/v3/jwk"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 	"github.com/veraison/ear"
@@ -62,7 +62,11 @@ embedded EAR claims-set and present a report of the trustworthiness vector.
 				return fmt.Errorf("parsing verification key from %q: %w", verifyPKey, err)
 			}
 
-			if err = ar.Verify(arBytes, jwa.KeyAlgorithmFrom(verifyAlg), vfyK); err != nil {
+			alg, err := jwa.KeyAlgorithmFrom(verifyAlg); if err != nil {
+				return fmt.Errorf("parsing algorithm from %q: %w", verifyAlg,  err)
+			}
+
+			if err = ar.Verify(arBytes, alg, vfyK); err != nil {
 				return fmt.Errorf("verifying signed EAR from %s: %w", verifyInput, err)
 			}
 

arc/cmd/verify_test.go

@@ -64,29 +64,7 @@ func Test_VerifyCmd_pkey_file_bad_format(t *testing.T) {
 	}
 	cmd.SetArgs(args)
 
-	expectedErr := `parsing verification key from "empty-pkey.json": failed to unmarshal JSON into key hint: EOF`
-
-	err := cmd.Execute()
-	assert.EqualError(t, err, expectedErr)
-}
-
-func Test_VerifyCmd_skey_not_ok_for_verifying(t *testing.T) {
-	cmd := NewVerifyCmd()
-
-	files := []fileEntry{
-		{"ear.jwt", testJWT},
-		{"skey.json", testSKey},
-	}
-	makeFS(t, files)
-
-	args := []string{
-		"--pkey=skey.json",
-		"--alg=ES256",
-		"ear.jwt",
-	}
-	cmd.SetArgs(args)
-
-	expectedErr := `verifying signed EAR from ear.jwt: failed verifying JWT message: could not verify message using any of the signatures or keys`
+	expectedErr := `parsing verification key from "empty-pkey.json": jwk.Parse: failed to probe data: probe: failed to unmarshal data: EOF`
 
 	err := cmd.Execute()
 	assert.EqualError(t, err, expectedErr)
@@ -129,7 +107,7 @@ func Test_VerifyCmd_input_file_bad_format(t *testing.T) {
 	}
 	cmd.SetArgs(args)
 
-	expectedErr := `verifying signed EAR from ear.jwt: failed verifying JWT message: failed to parse jws: invalid byte sequence`
+	expectedErr := `verifying signed EAR from ear.jwt: failed verifying JWT message: jwt.Parse: failed to parse token: jwt.verifyFast: failed to split compact: jwsbb: invalid number of segments`
 
 	err := cmd.Execute()
 	assert.EqualError(t, err, expectedErr)
@@ -151,7 +129,7 @@ func Test_VerifyCmd_unknown_verification_alg(t *testing.T) {
 	}
 	cmd.SetArgs(args)
 
-	expectedErr := `verifying signed EAR from ear.jwt: failed verifying JWT message: WithKey() option must be specified using jwa.SignatureAlgorithm (got jwa.InvalidKeyAlgorithm)`
+	expectedErr := `parsing algorithm from "XYZ": invalid key value: "XYZ": invalid key algorithm`
 
 	err := cmd.Execute()
 	assert.EqualError(t, err, expectedErr)

doc.go

@@ -13,60 +13,60 @@ The mandatory attributes are: status, issued_at, profile, submods, and verifier_
 For example, a simple AttestationResult payload with only the bare minimum
 claims could be created as follows:
 
-    myStatus := TrustTierAffirming
-    myTimestamp := time.Now().Unix()
-    myPolicyID := `https://veraison.example/policy/1A4DF345-B512-4F3B-8461-967DE7F60ECA`
-    myProfile := EatProfile
-    verifierBuild := "verifier-build"
-    verifierDeveloper := "verifier-developer"
-
-    ar := AttestationResult{
-        Profile:  &myProfile,
-        IssuedAt: &myTimestamp,
-        Submods: map[string]*Appraisal{
-            "submodName": {
-                TrustVector:       &TrustVector{},
-                Status:            &myStatus,
-                AppraisalPolicyID: &myPolicyID,
-            },
-        },
-        VerifierID: &VerifierIdentity{
-            Build:     &verifierBuild,
-            Developer: &verifierDeveloper,
-        },
-    }
+	myStatus := TrustTierAffirming
+	myTimestamp := time.Now().Unix()
+	myPolicyID := `https://veraison.example/policy/1A4DF345-B512-4F3B-8461-967DE7F60ECA`
+	myProfile := EatProfile
+	verifierBuild := "verifier-build"
+	verifierDeveloper := "verifier-developer"
+
+	ar := AttestationResult{
+	    Profile:  &myProfile,
+	    IssuedAt: &myTimestamp,
+	    Submods: map[string]*Appraisal{
+	        "submodName": {
+	            TrustVector:       &TrustVector{},
+	            Status:            &myStatus,
+	            AppraisalPolicyID: &myPolicyID,
+	        },
+	    },
+	    VerifierID: &VerifierIdentity{
+	        Build:     &verifierBuild,
+	        Developer: &verifierDeveloper,
+	    },
+	}
 
 A richer one would normally include the Trustworthiness Vector, which provides
 details about the appraised attester components. In the example below, the
 attester has been assessed as genuine, i.e., all claims are in the "affirming"
 range. (See §2.3 of draft-ietf-rats-ar4si-03 for details about the allowed values
 and their meaning.)
 
-    tv := TrustVector{
-        InstanceIdentity: 2,
-        Configuration:    2,
-        Executables:      2,
-        Hardware:         2,
-    }
+	tv := TrustVector{
+	    InstanceIdentity: 2,
+	    Configuration:    2,
+	    Executables:      2,
+	    Hardware:         2,
+	}
 
-    ar.Submods["submodName"].TrustVector = &tv
+	ar.Submods["submodName"].TrustVector = &tv
 
 # Signing and Serializing
 
 Once the AttestationResult is populated, it can be signed (i.e., wrapped in a
 JWT) by invoking the Sign method:
 
-    myECDSAPrivateKey := `{
-        "kty": "EC",
-        "crv": "P-256",
-        "x": "usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8",
-        "y": "IBOL-C3BttVivg-lSreASjpkttcsz-1rb7btKLv8EX4",
-        "d": "V8kgd2ZBRuh2dgyVINBUqpPDr7BOMGcF22CQMIUHtNM"
-    }`
+	myECDSAPrivateKey := `{
+	    "kty": "EC",
+	    "crv": "P-256",
+	    "x": "usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8",
+	    "y": "IBOL-C3BttVivg-lSreASjpkttcsz-1rb7btKLv8EX4",
+	    "d": "V8kgd2ZBRuh2dgyVINBUqpPDr7BOMGcF22CQMIUHtNM"
+	}`
 
-    sigK, _ := jwk.ParseKey([]byte(myECDSAPrivateKey))
+	sigK, _ := jwk.ParseKey([]byte(myECDSAPrivateKey))
 
-    buf, _ := ar.Sign(jwa.ES256, sigK)
+	buf, _ := ar.Sign(jwa.ES256, sigK)
 
 In this case, the returned buf contains a signed ES256 JWT with the JSON
 serialization of the AttestationResult object as its payload. This is the usual
@@ -78,38 +78,38 @@ On the consumer end of the protocol, when the EAT containing the attestation
 result is received from a veraison verifier, the relying party needs to first
 parse it and verify the signature using the Verify method:
 
-    myECDSAPublicKey := `{
-        "kty": "EC",
-        "crv": "P-256",
-        "x": "usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8",
-        "y": "IBOL-C3BttVivg-lSreASjpkttcsz-1rb7btKLv8EX4"
-    }`
+	myECDSAPublicKey := `{
+	    "kty": "EC",
+	    "crv": "P-256",
+	    "x": "usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8",
+	    "y": "IBOL-C3BttVivg-lSreASjpkttcsz-1rb7btKLv8EX4"
+	}`
 
-    vfyK, _ := jwk.ParseKey([]byte(myECDSAPublicKey))
+	vfyK, _ := jwk.ParseKey([]byte(myECDSAPublicKey))
 
-    var ar AttestationResult
+	var ar AttestationResult
 
-    err := ar.Verify(token, jwa.ES256, vfyK)
-    if err != nil {
-        // handle verification error
-    }
+	err := ar.Verify(token, jwa.ES256, vfyK)
+	if err != nil {
+	    // handle verification error
+	}
 
 If there are no errors, the relying party can trust the attestation result and
 inspect the relevant fields to decide about the trustworthiness of the attested
 entity.
 
-    if *ar.Submods["submodName"].Status != TrustTierAffirming {
-        // handle troubles with appraisal
-    }
+	if *ar.Submods["submodName"].Status != TrustTierAffirming {
+	    // handle troubles with appraisal
+	}
 
 # Pretty printing
 
 The package provides a Report method that allows pretty printing of the
 Trustworthiness Vector. The caller can request a short summary or a detailed
 printout, as well as using colors when displaying the claims' values.
 
-    short, color := true, true
+	short, color := true, true
 
-    fmt.Print(ar.Submods["submodName"].TrustVector.Report(short, color))
+	fmt.Print(ar.Submods["submodName"].TrustVector.Report(short, color))
 */
 package ear

ear.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lestrrat-go/jwx/v2/jwa"
-	"github.com/lestrrat-go/jwx/v2/jwt"
+	"github.com/lestrrat-go/jwx/v3/jwa"
+	"github.com/lestrrat-go/jwx/v3/jwt"
 )
 
 // EatProfile is the EAT profile implemented by this package
@@ -195,8 +195,16 @@ func (o *AttestationResult) Verify(data []byte, alg jwa.KeyAlgorithm, key interf
 		return fmt.Errorf("failed verifying JWT message: %w", err)
 	}
 
-	claims := token.PrivateClaims()
-	claims["iat"] = token.IssuedAt().Unix()
+	claims := make(map[string]any)
+	for _, k := range token.Keys() {
+		var v any
+		if err := token.Get(k, &v); err != nil {
+			return fmt.Errorf(`failed to get claim %s: %w`, k, err)
+		}
+		claims[k] = v
+	}
+	iat, _ := token.IssuedAt()
+	claims["iat"] = iat.Unix()
 
 	return o.populateFromMap(claims)
 }