Revert "CC-796: Remove dependency on unsupported version of go-oidc"

This reverts commit 0899d6a136.

vendor/gopkg.in/coreos/go-oidc.v2/.travis.yml

@@ -1,13 +1,13 @@
 language: go
 
 go:
-  - "1.12"
-  - "1.13"
+  - "1.9"
+  - "1.10"
 
 install:
  - go get -v -t github.com/coreos/go-oidc/...
  - go get golang.org/x/tools/cmd/cover
- - go get golang.org/x/lint/golint
+ - go get github.com/golang/lint/golint
 
 script:
  - ./test

vendor/gopkg.in/coreos/go-oidc.v2/oidc.go

@@ -69,7 +69,6 @@ type Provider struct {
 	authURL     string
 	tokenURL    string
 	userInfoURL string
-	algorithms  []string
 
 	// Raw claims returned by the server.
 	rawClaims []byte
@@ -83,27 +82,11 @@ type cachedKeys struct {
 }
 
 type providerJSON struct {
-	Issuer      string   `json:"issuer"`
-	AuthURL     string   `json:"authorization_endpoint"`
-	TokenURL    string   `json:"token_endpoint"`
-	JWKSURL     string   `json:"jwks_uri"`
-	UserInfoURL string   `json:"userinfo_endpoint"`
-	Algorithms  []string `json:"id_token_signing_alg_values_supported"`
-}
-
-// supportedAlgorithms is a list of algorithms explicitly supported by this
-// package. If a provider supports other algorithms, such as HS256 or none,
-// those values won't be passed to the IDTokenVerifier.
-var supportedAlgorithms = map[string]bool{
-	RS256: true,
-	RS384: true,
-	RS512: true,
-	ES256: true,
-	ES384: true,
-	ES512: true,
-	PS256: true,
-	PS384: true,
-	PS512: true,
+	Issuer      string `json:"issuer"`
+	AuthURL     string `json:"authorization_endpoint"`
+	TokenURL    string `json:"token_endpoint"`
+	JWKSURL     string `json:"jwks_uri"`
+	UserInfoURL string `json:"userinfo_endpoint"`
 }
 
 // NewProvider uses the OpenID Connect discovery mechanism to construct a Provider.
@@ -140,18 +123,11 @@ func NewProvider(ctx context.Context, issuer string) (*Provider, error) {
 	if p.Issuer != issuer {
 		return nil, fmt.Errorf("oidc: issuer did not match the issuer returned by provider, expected %q got %q", issuer, p.Issuer)
 	}
-	var algs []string
-	for _, a := range p.Algorithms {
-		if supportedAlgorithms[a] {
-			algs = append(algs, a)
-		}
-	}
 	return &Provider{
 		issuer:       p.Issuer,
 		authURL:      p.AuthURL,
 		tokenURL:     p.TokenURL,
 		userInfoURL:  p.UserInfoURL,
-		algorithms:   algs,
 		rawClaims:    body,
 		remoteKeySet: NewRemoteKeySet(ctx, p.JWKSURL),
 	}, nil

vendor/gopkg.in/coreos/go-oidc.v2/verify.go

@@ -79,9 +79,7 @@ type Config struct {
 	ClientID string
 	// If specified, only this set of algorithms may be used to sign the JWT.
 	//
-	// If the IDTokenVerifier is created from a provider with (*Provider).Verifier, this
-	// defaults to the set of algorithms the provider supports. Otherwise this values
-	// defaults to RS256.
+	// Since many providers only support RS256, SupportedSigningAlgs defaults to this value.
 	SupportedSigningAlgs []string
 
 	// If true, no ClientID check performed. Must be true if ClientID field is empty.
@@ -107,13 +105,6 @@ type Config struct {
 // The returned IDTokenVerifier is tied to the Provider's context and its behavior is
 // undefined once the Provider's context is canceled.
 func (p *Provider) Verifier(config *Config) *IDTokenVerifier {
-	if len(config.SupportedSigningAlgs) == 0 && len(p.algorithms) > 0 {
-		// Make a copy so we don't modify the config values.
-		cp := &Config{}
-		*cp = *config
-		cp.SupportedSigningAlgs = p.algorithms
-		config = cp
-	}
 	return NewVerifier(p.issuer, p.remoteKeySet, config)
 }
 

vendor/gopkg.in/square/go-jose.v2/.gitignore

@@ -5,4 +5,3 @@
 *.pem
 *.cov
 jose-util/jose-util
-jose-util.t.err

vendor/gopkg.in/square/go-jose.v2/.travis.yml

@@ -8,8 +8,8 @@ matrix:
     - go: tip
 
 go:
-- '1.14.x'
-- '1.15.x'
+- '1.11.x'
+- '1.12.x'
 - tip
 
 go_import_path: gopkg.in/square/go-jose.v2
@@ -26,8 +26,6 @@ before_install:
 - go get github.com/wadey/gocovmerge
 - go get github.com/mattn/goveralls
 - go get github.com/stretchr/testify/assert
-- go get github.com/stretchr/testify/require
-- go get github.com/google/go-cmp/cmp
 - go get golang.org/x/tools/cmd/cover || true
 - go get code.google.com/p/go.tools/cmd/cover || true
 - pip install cram --user
@@ -37,9 +35,10 @@ script:
 - go test ./cipher -v -covermode=count -coverprofile=cipher/profile.cov
 - go test ./jwt -v -covermode=count -coverprofile=jwt/profile.cov
 - go test ./json -v # no coverage for forked encoding/json package
-- cd jose-util && go build && PATH=$PWD:$PATH cram -v jose-util.t # cram tests jose-util
+- cd jose-util && go build && PATH=$PWD:$PATH cram -v jose-util.t
 - cd ..
 
 after_success:
 - gocovmerge *.cov */*.cov > merged.coverprofile
 - $HOME/gopath/bin/goveralls -coverprofile merged.coverprofile -service=travis-ci
+

vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go

@@ -150,7 +150,7 @@ func (ctx *cbcAEAD) computeAuthTag(aad, nonce, ciphertext []byte) []byte {
 	return hmac.Sum(nil)[:ctx.authtagBytes]
 }
 
-// resize ensures that the given slice has a capacity of at least n bytes.
+// resize ensures the the given slice has a capacity of at least n bytes.
 // If the capacity of the slice is less than n, a new slice is allocated
 // and the existing data will be copied.
 func resize(in []byte, n uint64) (head, tail []byte) {

vendor/gopkg.in/square/go-jose.v2/crypter.go

@@ -216,7 +216,6 @@ func NewMultiEncrypter(enc ContentEncryption, rcpts []Recipient, opts *Encrypter
 
 	if opts != nil {
 		encrypter.compressionAlg = opts.Compression
-		encrypter.extraHeaders = opts.ExtraHeaders
 	}
 
 	for _, recipient := range rcpts {

vendor/gopkg.in/square/go-jose.v2/encoding.go

@@ -23,12 +23,13 @@ import (
 	"encoding/binary"
 	"io"
 	"math/big"
-	"strings"
-	"unicode"
+	"regexp"
 
 	"gopkg.in/square/go-jose.v2/json"
 )
 
+var stripWhitespaceRegex = regexp.MustCompile("\\s")
+
 // Helper function to serialize known-good objects.
 // Precondition: value is not a nil pointer.
 func mustSerializeJSON(value interface{}) []byte {
@@ -55,14 +56,7 @@ func mustSerializeJSON(value interface{}) []byte {
 
 // Strip all newlines and whitespace
 func stripWhitespace(data string) string {
-	buf := strings.Builder{}
-	buf.Grow(len(data))
-	for _, r := range data {
-		if !unicode.IsSpace(r) {
-			buf.WriteRune(r)
-		}
-	}
-	return buf.String()
+	return stripWhitespaceRegex.ReplaceAllString(data, "")
 }
 
 // Perform compression based on algorithm

vendor/gopkg.in/square/go-jose.v2/json/decode.go

@@ -13,7 +13,6 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"math"
 	"reflect"
 	"runtime"
 	"strconv"
@@ -246,18 +245,6 @@ func isValidNumber(s string) bool {
 	return s == ""
 }
 
-type NumberUnmarshalType int
-
-const (
-	// unmarshal a JSON number into an interface{} as a float64
-	UnmarshalFloat NumberUnmarshalType = iota
-	// unmarshal a JSON number into an interface{} as a `json.Number`
-	UnmarshalJSONNumber
-	// unmarshal a JSON number into an interface{} as a int64
-	// if value is an integer otherwise float64
-	UnmarshalIntOrFloat
-)
-
 // decodeState represents the state while decoding a JSON value.
 type decodeState struct {
 	data       []byte
@@ -265,7 +252,7 @@ type decodeState struct {
 	scan       scanner
 	nextscan   scanner // for calls to nextValue
 	savedError error
-	numberType NumberUnmarshalType
+	useNumber  bool
 }
 
 // errPhase is used for errors that should not happen unless
@@ -736,38 +723,17 @@ func (d *decodeState) literal(v reflect.Value) {
 	d.literalStore(d.data[start:d.off], v, false)
 }
 
-// convertNumber converts the number literal s to a float64, int64 or a Number
-// depending on d.numberDecodeType.
+// convertNumber converts the number literal s to a float64 or a Number
+// depending on the setting of d.useNumber.
 func (d *decodeState) convertNumber(s string) (interface{}, error) {
-	switch d.numberType {
-
-	case UnmarshalJSONNumber:
+	if d.useNumber {
 		return Number(s), nil
-	case UnmarshalIntOrFloat:
-		v, err := strconv.ParseInt(s, 10, 64)
-		if err == nil {
-			return v, nil
-		}
-
-		// tries to parse integer number in scientific notation
-		f, err := strconv.ParseFloat(s, 64)
-		if err != nil {
-			return nil, &UnmarshalTypeError{"number " + s, reflect.TypeOf(0.0), int64(d.off)}
-		}
-
-		// if it has no decimal value use int64
-		if fi, fd := math.Modf(f); fd == 0.0 {
-			return int64(fi), nil
-		}
-		return f, nil
-	default:
-		f, err := strconv.ParseFloat(s, 64)
-		if err != nil {
-			return nil, &UnmarshalTypeError{"number " + s, reflect.TypeOf(0.0), int64(d.off)}
-		}
-		return f, nil
 	}
-
+	f, err := strconv.ParseFloat(s, 64)
+	if err != nil {
+		return nil, &UnmarshalTypeError{"number " + s, reflect.TypeOf(0.0), int64(d.off)}
+	}
+	return f, nil
 }
 
 var numberType = reflect.TypeOf(Number(""))

vendor/gopkg.in/square/go-jose.v2/json/stream.go

@@ -31,14 +31,9 @@ func NewDecoder(r io.Reader) *Decoder {
 	return &Decoder{r: r}
 }
 
-// Deprecated: Use `SetNumberType` instead
 // UseNumber causes the Decoder to unmarshal a number into an interface{} as a
 // Number instead of as a float64.
-func (dec *Decoder) UseNumber() { dec.d.numberType = UnmarshalJSONNumber }
-
-// SetNumberType causes the Decoder to unmarshal a number into an interface{} as a
-// Number, float64 or int64 depending on `t` enum value.
-func (dec *Decoder) SetNumberType(t NumberUnmarshalType) { dec.d.numberType = t }
+func (dec *Decoder) UseNumber() { dec.d.useNumber = true }
 
 // Decode reads the next JSON-encoded value from its
 // input and stores it in the value pointed to by v.

vendor/gopkg.in/square/go-jose.v2/jwk.go

@@ -17,20 +17,15 @@
 package jose
 
 import (
-	"bytes"
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rsa"
-	"crypto/sha1"
-	"crypto/sha256"
 	"crypto/x509"
 	"encoding/base64"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"math/big"
-	"net/url"
 	"reflect"
 	"strings"
 
@@ -62,31 +57,16 @@ type rawJSONWebKey struct {
 	Dq *byteBuffer `json:"dq,omitempty"`
 	Qi *byteBuffer `json:"qi,omitempty"`
 	// Certificates
-	X5c       []string `json:"x5c,omitempty"`
-	X5u       *url.URL `json:"x5u,omitempty"`
-	X5tSHA1   string   `json:"x5t,omitempty"`
-	X5tSHA256 string   `json:"x5t#S256,omitempty"`
+	X5c []string `json:"x5c,omitempty"`
 }
 
 // JSONWebKey represents a public or private key in JWK format.
 type JSONWebKey struct {
-	// Cryptographic key, can be a symmetric or asymmetric key.
-	Key interface{}
-	// Key identifier, parsed from `kid` header.
-	KeyID string
-	// Key algorithm, parsed from `alg` header.
-	Algorithm string
-	// Key use, parsed from `use` header.
-	Use string
-
-	// X.509 certificate chain, parsed from `x5c` header.
+	Key          interface{}
 	Certificates []*x509.Certificate
-	// X.509 certificate URL, parsed from `x5u` header.
-	CertificatesURL *url.URL
-	// X.509 certificate thumbprint (SHA-1), parsed from `x5t` header.
-	CertificateThumbprintSHA1 []byte
-	// X.509 certificate thumbprint (SHA-256), parsed from `x5t#S256` header.
-	CertificateThumbprintSHA256 []byte
+	KeyID        string
+	Algorithm    string
+	Use          string
 }
 
 // MarshalJSON serializes the given key to its JSON representation.
@@ -125,39 +105,6 @@ func (k JSONWebKey) MarshalJSON() ([]byte, error) {
 		raw.X5c = append(raw.X5c, base64.StdEncoding.EncodeToString(cert.Raw))
 	}
 
-	x5tSHA1Len := len(k.CertificateThumbprintSHA1)
-	x5tSHA256Len := len(k.CertificateThumbprintSHA256)
-	if x5tSHA1Len > 0 {
-		if x5tSHA1Len != sha1.Size {
-			return nil, fmt.Errorf("square/go-jose: invalid SHA-1 thumbprint (must be %d bytes, not %d)", sha1.Size, x5tSHA1Len)
-		}
-		raw.X5tSHA1 = base64.RawURLEncoding.EncodeToString(k.CertificateThumbprintSHA1)
-	}
-	if x5tSHA256Len > 0 {
-		if x5tSHA256Len != sha256.Size {
-			return nil, fmt.Errorf("square/go-jose: invalid SHA-256 thumbprint (must be %d bytes, not %d)", sha256.Size, x5tSHA256Len)
-		}
-		raw.X5tSHA256 = base64.RawURLEncoding.EncodeToString(k.CertificateThumbprintSHA256)
-	}
-
-	// If cert chain is attached (as opposed to being behind a URL), check the
-	// keys thumbprints to make sure they match what is expected. This is to
-	// ensure we don't accidentally produce a JWK with semantically inconsistent
-	// data in the headers.
-	if len(k.Certificates) > 0 {
-		expectedSHA1 := sha1.Sum(k.Certificates[0].Raw)
-		expectedSHA256 := sha256.Sum256(k.Certificates[0].Raw)
-
-		if len(k.CertificateThumbprintSHA1) > 0 && !bytes.Equal(k.CertificateThumbprintSHA1, expectedSHA1[:]) {
-			return nil, errors.New("square/go-jose: invalid SHA-1 thumbprint, does not match cert chain")
-		}
-		if len(k.CertificateThumbprintSHA256) > 0 && !bytes.Equal(k.CertificateThumbprintSHA256, expectedSHA256[:]) {
-			return nil, errors.New("square/go-jose: invalid or SHA-256 thumbprint, does not match cert chain")
-		}
-	}
-
-	raw.X5u = k.CertificatesURL
-
 	return json.Marshal(raw)
 }
 
@@ -169,61 +116,28 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) {
 		return err
 	}
 
-	certs, err := parseCertificateChain(raw.X5c)
-	if err != nil {
-		return fmt.Errorf("square/go-jose: failed to unmarshal x5c field: %s", err)
-	}
-
 	var key interface{}
-	var certPub interface{}
-	var keyPub interface{}
-
-	if len(certs) > 0 {
-		// We need to check that leaf public key matches the key embedded in this
-		// JWK, as required by the standard (see RFC 7517, Section 4.7). Otherwise
-		// the JWK parsed could be semantically invalid. Technically, should also
-		// check key usage fields and other extensions on the cert here, but the
-		// standard doesn't exactly explain how they're supposed to map from the
-		// JWK representation to the X.509 extensions.
-		certPub = certs[0].PublicKey
-	}
-
 	switch raw.Kty {
 	case "EC":
 		if raw.D != nil {
 			key, err = raw.ecPrivateKey()
-			if err == nil {
-				keyPub = key.(*ecdsa.PrivateKey).Public()
-			}
 		} else {
 			key, err = raw.ecPublicKey()
-			keyPub = key
 		}
 	case "RSA":
 		if raw.D != nil {
 			key, err = raw.rsaPrivateKey()
-			if err == nil {
-				keyPub = key.(*rsa.PrivateKey).Public()
-			}
 		} else {
 			key, err = raw.rsaPublicKey()
-			keyPub = key
 		}
 	case "oct":
-		if certPub != nil {
-			return errors.New("square/go-jose: invalid JWK, found 'oct' (symmetric) key with cert chain")
-		}
 		key, err = raw.symmetricKey()
 	case "OKP":
 		if raw.Crv == "Ed25519" && raw.X != nil {
 			if raw.D != nil {
 				key, err = raw.edPrivateKey()
-				if err == nil {
-					keyPub = key.(ed25519.PrivateKey).Public()
-				}
 			} else {
 				key, err = raw.edPublicKey()
-				keyPub = key
 			}
 		} else {
 			err = fmt.Errorf("square/go-jose: unknown curve %s'", raw.Crv)
@@ -232,78 +146,12 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) {
 		err = fmt.Errorf("square/go-jose: unknown json web key type '%s'", raw.Kty)
 	}
 
-	if err != nil {
-		return
-	}
+	if err == nil {
+		*k = JSONWebKey{Key: key, KeyID: raw.Kid, Algorithm: raw.Alg, Use: raw.Use}
 
-	if certPub != nil && keyPub != nil {
-		if !reflect.DeepEqual(certPub, keyPub) {
-			return errors.New("square/go-jose: invalid JWK, public keys in key and x5c fields do not match")
-		}
-	}
-
-	*k = JSONWebKey{Key: key, KeyID: raw.Kid, Algorithm: raw.Alg, Use: raw.Use, Certificates: certs}
-
-	k.CertificatesURL = raw.X5u
-
-	// x5t parameters are base64url-encoded SHA thumbprints
-	// See RFC 7517, Section 4.8, https://tools.ietf.org/html/rfc7517#section-4.8
-	x5tSHA1bytes, err := base64.RawURLEncoding.DecodeString(raw.X5tSHA1)
-	if err != nil {
-		return errors.New("square/go-jose: invalid JWK, x5t header has invalid encoding")
-	}
-
-	// RFC 7517, Section 4.8 is ambiguous as to whether the digest output should be byte or hex,
-	// for this reason, after base64 decoding, if the size is sha1.Size it's likely that the value is a byte encoded
-	// checksum so we skip this. Otherwise if the checksum was hex encoded we expect a 40 byte sized array so we'll
-	// try to hex decode it. When Marshalling this value we'll always use a base64 encoded version of byte format checksum.
-	if len(x5tSHA1bytes) == 2*sha1.Size {
-		hx, err := hex.DecodeString(string(x5tSHA1bytes))
+		k.Certificates, err = parseCertificateChain(raw.X5c)
 		if err != nil {
-			return fmt.Errorf("square/go-jose: invalid JWK, unable to hex decode x5t: %v", err)
-
-		}
-		x5tSHA1bytes = hx
-	}
-
-	k.CertificateThumbprintSHA1 = x5tSHA1bytes
-
-	x5tSHA256bytes, err := base64.RawURLEncoding.DecodeString(raw.X5tSHA256)
-	if err != nil {
-		return errors.New("square/go-jose: invalid JWK, x5t#S256 header has invalid encoding")
-	}
-
-	if len(x5tSHA256bytes) == 2*sha256.Size {
-		hx256, err := hex.DecodeString(string(x5tSHA256bytes))
-		if err != nil {
-			return fmt.Errorf("square/go-jose: invalid JWK, unable to hex decode x5t#S256: %v", err)
-		}
-		x5tSHA256bytes = hx256
-	}
-
-	k.CertificateThumbprintSHA256 = x5tSHA256bytes
-
-	x5tSHA1Len := len(k.CertificateThumbprintSHA1)
-	x5tSHA256Len := len(k.CertificateThumbprintSHA256)
-	if x5tSHA1Len > 0 && x5tSHA1Len != sha1.Size {
-		return errors.New("square/go-jose: invalid JWK, x5t header is of incorrect size")
-	}
-	if x5tSHA256Len > 0 && x5tSHA256Len != sha256.Size {
-		return errors.New("square/go-jose: invalid JWK, x5t#S256 header is of incorrect size")
-	}
-
-	// If certificate chain *and* thumbprints are set, verify correctness.
-	if len(k.Certificates) > 0 {
-		leaf := k.Certificates[0]
-		sha1sum := sha1.Sum(leaf.Raw)
-		sha256sum := sha256.Sum256(leaf.Raw)
-
-		if len(k.CertificateThumbprintSHA1) > 0 && !bytes.Equal(sha1sum[:], k.CertificateThumbprintSHA1) {
-			return errors.New("square/go-jose: invalid JWK, x5c thumbprint does not match x5t value")
-		}
-
-		if len(k.CertificateThumbprintSHA256) > 0 && !bytes.Equal(sha256sum[:], k.CertificateThumbprintSHA256) {
-			return errors.New("square/go-jose: invalid JWK, x5c thumbprint does not match x5t#S256 value")
+			return fmt.Errorf("failed to unmarshal x5c field: %s", err)
 		}
 	}
 
@@ -332,7 +180,7 @@ func (s *JSONWebKeySet) Key(kid string) []JSONWebKey {
 
 const rsaThumbprintTemplate = `{"e":"%s","kty":"RSA","n":"%s"}`
 const ecThumbprintTemplate = `{"crv":"%s","kty":"EC","x":"%s","y":"%s"}`
-const edThumbprintTemplate = `{"crv":"%s","kty":"OKP","x":"%s"}`
+const edThumbprintTemplate = `{"crv":"%s","kty":"OKP",x":"%s"}`
 
 func ecThumbprintInput(curve elliptic.Curve, x, y *big.Int) (string, error) {
 	coordLength := curveSize(curve)
@@ -406,7 +254,7 @@ func (k *JSONWebKey) IsPublic() bool {
 	}
 }
 
-// Public creates JSONWebKey with corresponding public key if JWK represents asymmetric private key.
+// Public creates JSONWebKey with corresponding publik key if JWK represents asymmetric private key.
 func (k *JSONWebKey) Public() JSONWebKey {
 	if k.IsPublic() {
 		return *k

vendor/gopkg.in/square/go-jose.v2/jws.go

@@ -102,14 +102,14 @@ func (sig Signature) mergedHeaders() rawHeader {
 }
 
 // Compute data to be signed
-func (obj JSONWebSignature) computeAuthData(payload []byte, signature *Signature) ([]byte, error) {
+func (obj JSONWebSignature) computeAuthData(payload []byte, signature *Signature) []byte {
 	var authData bytes.Buffer
 
 	protectedHeader := new(rawHeader)
 
 	if signature.original != nil && signature.original.Protected != nil {
 		if err := json.Unmarshal(signature.original.Protected.bytes(), protectedHeader); err != nil {
-			return nil, err
+			panic(err)
 		}
 		authData.WriteString(signature.original.Protected.base64())
 	} else if signature.protected != nil {
@@ -134,7 +134,7 @@ func (obj JSONWebSignature) computeAuthData(payload []byte, signature *Signature
 		authData.Write(payload)
 	}
 
-	return authData.Bytes(), nil
+	return authData.Bytes()
 }
 
 // parseSignedFull parses a message in full format.

vendor/gopkg.in/square/go-jose.v2/jwt/builder.go

@@ -1,334 +0,0 @@
-/*-
- * Copyright 2016 Zbigniew Mandziejewicz
- * Copyright 2016 Square, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package jwt
-
-import (
-	"bytes"
-	"reflect"
-
-	"gopkg.in/square/go-jose.v2/json"
-
-	"gopkg.in/square/go-jose.v2"
-)
-
-// Builder is a utility for making JSON Web Tokens. Calls can be chained, and
-// errors are accumulated until the final call to CompactSerialize/FullSerialize.
-type Builder interface {
-	// Claims encodes claims into JWE/JWS form. Multiple calls will merge claims
-	// into single JSON object. If you are passing private claims, make sure to set
-	// struct field tags to specify the name for the JSON key to be used when
-	// serializing.
-	Claims(i interface{}) Builder
-	// Token builds a JSONWebToken from provided data.
-	Token() (*JSONWebToken, error)
-	// FullSerialize serializes a token using the full serialization format.
-	FullSerialize() (string, error)
-	// CompactSerialize serializes a token using the compact serialization format.
-	CompactSerialize() (string, error)
-}
-
-// NestedBuilder is a utility for making Signed-Then-Encrypted JSON Web Tokens.
-// Calls can be chained, and errors are accumulated until final call to
-// CompactSerialize/FullSerialize.
-type NestedBuilder interface {
-	// Claims encodes claims into JWE/JWS form. Multiple calls will merge claims
-	// into single JSON object. If you are passing private claims, make sure to set
-	// struct field tags to specify the name for the JSON key to be used when
-	// serializing.
-	Claims(i interface{}) NestedBuilder
-	// Token builds a NestedJSONWebToken from provided data.
-	Token() (*NestedJSONWebToken, error)
-	// FullSerialize serializes a token using the full serialization format.
-	FullSerialize() (string, error)
-	// CompactSerialize serializes a token using the compact serialization format.
-	CompactSerialize() (string, error)
-}
-
-type builder struct {
-	payload map[string]interface{}
-	err     error
-}
-
-type signedBuilder struct {
-	builder
-	sig jose.Signer
-}
-
-type encryptedBuilder struct {
-	builder
-	enc jose.Encrypter
-}
-
-type nestedBuilder struct {
-	builder
-	sig jose.Signer
-	enc jose.Encrypter
-}
-
-// Signed creates builder for signed tokens.
-func Signed(sig jose.Signer) Builder {
-	return &signedBuilder{
-		sig: sig,
-	}
-}
-
-// Encrypted creates builder for encrypted tokens.
-func Encrypted(enc jose.Encrypter) Builder {
-	return &encryptedBuilder{
-		enc: enc,
-	}
-}
-
-// SignedAndEncrypted creates builder for signed-then-encrypted tokens.
-// ErrInvalidContentType will be returned if encrypter doesn't have JWT content type.
-func SignedAndEncrypted(sig jose.Signer, enc jose.Encrypter) NestedBuilder {
-	if contentType, _ := enc.Options().ExtraHeaders[jose.HeaderContentType].(jose.ContentType); contentType != "JWT" {
-		return &nestedBuilder{
-			builder: builder{
-				err: ErrInvalidContentType,
-			},
-		}
-	}
-	return &nestedBuilder{
-		sig: sig,
-		enc: enc,
-	}
-}
-
-func (b builder) claims(i interface{}) builder {
-	if b.err != nil {
-		return b
-	}
-
-	m, ok := i.(map[string]interface{})
-	switch {
-	case ok:
-		return b.merge(m)
-	case reflect.Indirect(reflect.ValueOf(i)).Kind() == reflect.Struct:
-		m, err := normalize(i)
-		if err != nil {
-			return builder{
-				err: err,
-			}
-		}
-		return b.merge(m)
-	default:
-		return builder{
-			err: ErrInvalidClaims,
-		}
-	}
-}
-
-func normalize(i interface{}) (map[string]interface{}, error) {
-	m := make(map[string]interface{})
-
-	raw, err := json.Marshal(i)
-	if err != nil {
-		return nil, err
-	}
-
-	d := json.NewDecoder(bytes.NewReader(raw))
-	d.SetNumberType(json.UnmarshalJSONNumber)
-
-	if err := d.Decode(&m); err != nil {
-		return nil, err
-	}
-
-	return m, nil
-}
-
-func (b *builder) merge(m map[string]interface{}) builder {
-	p := make(map[string]interface{})
-	for k, v := range b.payload {
-		p[k] = v
-	}
-	for k, v := range m {
-		p[k] = v
-	}
-
-	return builder{
-		payload: p,
-	}
-}
-
-func (b *builder) token(p func(interface{}) ([]byte, error), h []jose.Header) (*JSONWebToken, error) {
-	return &JSONWebToken{
-		payload: p,
-		Headers: h,
-	}, nil
-}
-
-func (b *signedBuilder) Claims(i interface{}) Builder {
-	return &signedBuilder{
-		builder: b.builder.claims(i),
-		sig:     b.sig,
-	}
-}
-
-func (b *signedBuilder) Token() (*JSONWebToken, error) {
-	sig, err := b.sign()
-	if err != nil {
-		return nil, err
-	}
-
-	h := make([]jose.Header, len(sig.Signatures))
-	for i, v := range sig.Signatures {
-		h[i] = v.Header
-	}
-
-	return b.builder.token(sig.Verify, h)
-}
-
-func (b *signedBuilder) CompactSerialize() (string, error) {
-	sig, err := b.sign()
-	if err != nil {
-		return "", err
-	}
-
-	return sig.CompactSerialize()
-}
-
-func (b *signedBuilder) FullSerialize() (string, error) {
-	sig, err := b.sign()
-	if err != nil {
-		return "", err
-	}
-
-	return sig.FullSerialize(), nil
-}
-
-func (b *signedBuilder) sign() (*jose.JSONWebSignature, error) {
-	if b.err != nil {
-		return nil, b.err
-	}
-
-	p, err := json.Marshal(b.payload)
-	if err != nil {
-		return nil, err
-	}
-
-	return b.sig.Sign(p)
-}
-
-func (b *encryptedBuilder) Claims(i interface{}) Builder {
-	return &encryptedBuilder{
-		builder: b.builder.claims(i),
-		enc:     b.enc,
-	}
-}
-
-func (b *encryptedBuilder) CompactSerialize() (string, error) {
-	enc, err := b.encrypt()
-	if err != nil {
-		return "", err
-	}
-
-	return enc.CompactSerialize()
-}
-
-func (b *encryptedBuilder) FullSerialize() (string, error) {
-	enc, err := b.encrypt()
-	if err != nil {
-		return "", err
-	}
-
-	return enc.FullSerialize(), nil
-}
-
-func (b *encryptedBuilder) Token() (*JSONWebToken, error) {
-	enc, err := b.encrypt()
-	if err != nil {
-		return nil, err
-	}
-
-	return b.builder.token(enc.Decrypt, []jose.Header{enc.Header})
-}
-
-func (b *encryptedBuilder) encrypt() (*jose.JSONWebEncryption, error) {
-	if b.err != nil {
-		return nil, b.err
-	}
-
-	p, err := json.Marshal(b.payload)
-	if err != nil {
-		return nil, err
-	}
-
-	return b.enc.Encrypt(p)
-}
-
-func (b *nestedBuilder) Claims(i interface{}) NestedBuilder {
-	return &nestedBuilder{
-		builder: b.builder.claims(i),
-		sig:     b.sig,
-		enc:     b.enc,
-	}
-}
-
-func (b *nestedBuilder) Token() (*NestedJSONWebToken, error) {
-	enc, err := b.signAndEncrypt()
-	if err != nil {
-		return nil, err
-	}
-
-	return &NestedJSONWebToken{
-		enc:     enc,
-		Headers: []jose.Header{enc.Header},
-	}, nil
-}
-
-func (b *nestedBuilder) CompactSerialize() (string, error) {
-	enc, err := b.signAndEncrypt()
-	if err != nil {
-		return "", err
-	}
-
-	return enc.CompactSerialize()
-}
-
-func (b *nestedBuilder) FullSerialize() (string, error) {
-	enc, err := b.signAndEncrypt()
-	if err != nil {
-		return "", err
-	}
-
-	return enc.FullSerialize(), nil
-}
-
-func (b *nestedBuilder) signAndEncrypt() (*jose.JSONWebEncryption, error) {
-	if b.err != nil {
-		return nil, b.err
-	}
-
-	p, err := json.Marshal(b.payload)
-	if err != nil {
-		return nil, err
-	}
-
-	sig, err := b.sig.Sign(p)
-	if err != nil {
-		return nil, err
-	}
-
-	p2, err := sig.CompactSerialize()
-	if err != nil {
-		return nil, err
-	}
-
-	return b.enc.Encrypt([]byte(p2))
-}

vendor/gopkg.in/square/go-jose.v2/jwt/claims.go

@@ -1,121 +0,0 @@
-/*-
- * Copyright 2016 Zbigniew Mandziejewicz
- * Copyright 2016 Square, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package jwt
-
-import (
-	"strconv"
-	"time"
-
-	"gopkg.in/square/go-jose.v2/json"
-)
-
-// Claims represents public claim values (as specified in RFC 7519).
-type Claims struct {
-	Issuer    string       `json:"iss,omitempty"`
-	Subject   string       `json:"sub,omitempty"`
-	Audience  Audience     `json:"aud,omitempty"`
-	Expiry    *NumericDate `json:"exp,omitempty"`
-	NotBefore *NumericDate `json:"nbf,omitempty"`
-	IssuedAt  *NumericDate `json:"iat,omitempty"`
-	ID        string       `json:"jti,omitempty"`
-}
-
-// NumericDate represents date and time as the number of seconds since the
-// epoch, ignoring leap seconds. Non-integer values can be represented
-// in the serialized format, but we round to the nearest second.
-// See RFC7519 Section 2: https://tools.ietf.org/html/rfc7519#section-2
-type NumericDate int64
-
-// NewNumericDate constructs NumericDate from time.Time value.
-func NewNumericDate(t time.Time) *NumericDate {
-	if t.IsZero() {
-		return nil
-	}
-
-	// While RFC 7519 technically states that NumericDate values may be
-	// non-integer values, we don't bother serializing timestamps in
-	// claims with sub-second accurancy and just round to the nearest
-	// second instead. Not convined sub-second accuracy is useful here.
-	out := NumericDate(t.Unix())
-	return &out
-}
-
-// MarshalJSON serializes the given NumericDate into its JSON representation.
-func (n NumericDate) MarshalJSON() ([]byte, error) {
-	return []byte(strconv.FormatInt(int64(n), 10)), nil
-}
-
-// UnmarshalJSON reads a date from its JSON representation.
-func (n *NumericDate) UnmarshalJSON(b []byte) error {
-	s := string(b)
-
-	f, err := strconv.ParseFloat(s, 64)
-	if err != nil {
-		return ErrUnmarshalNumericDate
-	}
-
-	*n = NumericDate(f)
-	return nil
-}
-
-// Time returns time.Time representation of NumericDate.
-func (n *NumericDate) Time() time.Time {
-	if n == nil {
-		return time.Time{}
-	}
-	return time.Unix(int64(*n), 0)
-}
-
-// Audience represents the recipients that the token is intended for.
-type Audience []string
-
-// UnmarshalJSON reads an audience from its JSON representation.
-func (s *Audience) UnmarshalJSON(b []byte) error {
-	var v interface{}
-	if err := json.Unmarshal(b, &v); err != nil {
-		return err
-	}
-
-	switch v := v.(type) {
-	case string:
-		*s = []string{v}
-	case []interface{}:
-		a := make([]string, len(v))
-		for i, e := range v {
-			s, ok := e.(string)
-			if !ok {
-				return ErrUnmarshalAudience
-			}
-			a[i] = s
-		}
-		*s = a
-	default:
-		return ErrUnmarshalAudience
-	}
-
-	return nil
-}
-
-func (s Audience) Contains(v string) bool {
-	for _, a := range s {
-		if a == v {
-			return true
-		}
-	}
-	return false
-}

vendor/gopkg.in/square/go-jose.v2/jwt/doc.go

@@ -1,22 +0,0 @@
-/*-
- * Copyright 2017 Square Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/*
-
-Package jwt provides an implementation of the JSON Web Token standard.
-
-*/
-package jwt

vendor/gopkg.in/square/go-jose.v2/jwt/errors.go

@@ -1,53 +0,0 @@
-/*-
- * Copyright 2016 Zbigniew Mandziejewicz
- * Copyright 2016 Square, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package jwt
-
-import "errors"
-
-// ErrUnmarshalAudience indicates that aud claim could not be unmarshalled.
-var ErrUnmarshalAudience = errors.New("square/go-jose/jwt: expected string or array value to unmarshal to Audience")
-
-// ErrUnmarshalNumericDate indicates that JWT NumericDate could not be unmarshalled.
-var ErrUnmarshalNumericDate = errors.New("square/go-jose/jwt: expected number value to unmarshal NumericDate")
-
-// ErrInvalidClaims indicates that given claims have invalid type.
-var ErrInvalidClaims = errors.New("square/go-jose/jwt: expected claims to be value convertible into JSON object")
-
-// ErrInvalidIssuer indicates invalid iss claim.
-var ErrInvalidIssuer = errors.New("square/go-jose/jwt: validation failed, invalid issuer claim (iss)")
-
-// ErrInvalidSubject indicates invalid sub claim.
-var ErrInvalidSubject = errors.New("square/go-jose/jwt: validation failed, invalid subject claim (sub)")
-
-// ErrInvalidAudience indicated invalid aud claim.
-var ErrInvalidAudience = errors.New("square/go-jose/jwt: validation failed, invalid audience claim (aud)")
-
-// ErrInvalidID indicates invalid jti claim.
-var ErrInvalidID = errors.New("square/go-jose/jwt: validation failed, invalid ID claim (jti)")
-
-// ErrNotValidYet indicates that token is used before time indicated in nbf claim.
-var ErrNotValidYet = errors.New("square/go-jose/jwt: validation failed, token not valid yet (nbf)")
-
-// ErrExpired indicates that token is used after expiry time indicated in exp claim.
-var ErrExpired = errors.New("square/go-jose/jwt: validation failed, token is expired (exp)")
-
-// ErrIssuedInTheFuture indicates that the iat field is in the future.
-var ErrIssuedInTheFuture = errors.New("square/go-jose/jwt: validation field, token issued in the future (iat)")
-
-// ErrInvalidContentType indicates that token requires JWT cty header.
-var ErrInvalidContentType = errors.New("square/go-jose/jwt: expected content type to be JWT (cty header)")

vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go

@@ -1,169 +0,0 @@
-/*-
- * Copyright 2016 Zbigniew Mandziejewicz
- * Copyright 2016 Square, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package jwt
-
-import (
-	"fmt"
-	"strings"
-
-	jose "gopkg.in/square/go-jose.v2"
-	"gopkg.in/square/go-jose.v2/json"
-)
-
-// JSONWebToken represents a JSON Web Token (as specified in RFC7519).
-type JSONWebToken struct {
-	payload           func(k interface{}) ([]byte, error)
-	unverifiedPayload func() []byte
-	Headers           []jose.Header
-}
-
-type NestedJSONWebToken struct {
-	enc     *jose.JSONWebEncryption
-	Headers []jose.Header
-}
-
-// Claims deserializes a JSONWebToken into dest using the provided key.
-func (t *JSONWebToken) Claims(key interface{}, dest ...interface{}) error {
-	payloadKey := tryJWKS(t.Headers, key)
-
-	b, err := t.payload(payloadKey)
-	if err != nil {
-		return err
-	}
-
-	for _, d := range dest {
-		if err := json.Unmarshal(b, d); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// UnsafeClaimsWithoutVerification deserializes the claims of a
-// JSONWebToken into the dests. For signed JWTs, the claims are not
-// verified. This function won't work for encrypted JWTs.
-func (t *JSONWebToken) UnsafeClaimsWithoutVerification(dest ...interface{}) error {
-	if t.unverifiedPayload == nil {
-		return fmt.Errorf("square/go-jose: Cannot get unverified claims")
-	}
-	claims := t.unverifiedPayload()
-	for _, d := range dest {
-		if err := json.Unmarshal(claims, d); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (t *NestedJSONWebToken) Decrypt(decryptionKey interface{}) (*JSONWebToken, error) {
-	key := tryJWKS(t.Headers, decryptionKey)
-
-	b, err := t.enc.Decrypt(key)
-	if err != nil {
-		return nil, err
-	}
-
-	sig, err := ParseSigned(string(b))
-	if err != nil {
-		return nil, err
-	}
-
-	return sig, nil
-}
-
-// ParseSigned parses token from JWS form.
-func ParseSigned(s string) (*JSONWebToken, error) {
-	sig, err := jose.ParseSigned(s)
-	if err != nil {
-		return nil, err
-	}
-	headers := make([]jose.Header, len(sig.Signatures))
-	for i, signature := range sig.Signatures {
-		headers[i] = signature.Header
-	}
-
-	return &JSONWebToken{
-		payload:           sig.Verify,
-		unverifiedPayload: sig.UnsafePayloadWithoutVerification,
-		Headers:           headers,
-	}, nil
-}
-
-// ParseEncrypted parses token from JWE form.
-func ParseEncrypted(s string) (*JSONWebToken, error) {
-	enc, err := jose.ParseEncrypted(s)
-	if err != nil {
-		return nil, err
-	}
-
-	return &JSONWebToken{
-		payload: enc.Decrypt,
-		Headers: []jose.Header{enc.Header},
-	}, nil
-}
-
-// ParseSignedAndEncrypted parses signed-then-encrypted token from JWE form.
-func ParseSignedAndEncrypted(s string) (*NestedJSONWebToken, error) {
-	enc, err := jose.ParseEncrypted(s)
-	if err != nil {
-		return nil, err
-	}
-
-	contentType, _ := enc.Header.ExtraHeaders[jose.HeaderContentType].(string)
-	if strings.ToUpper(contentType) != "JWT" {
-		return nil, ErrInvalidContentType
-	}
-
-	return &NestedJSONWebToken{
-		enc:     enc,
-		Headers: []jose.Header{enc.Header},
-	}, nil
-}
-
-func tryJWKS(headers []jose.Header, key interface{}) interface{} {
-	var jwks jose.JSONWebKeySet
-
-	switch jwksType := key.(type) {
-	case *jose.JSONWebKeySet:
-		jwks = *jwksType
-	case jose.JSONWebKeySet:
-		jwks = jwksType
-	default:
-		return key
-	}
-
-	var kid string
-	for _, header := range headers {
-		if header.KeyID != "" {
-			kid = header.KeyID
-			break
-		}
-	}
-
-	if kid == "" {
-		return key
-	}
-
-	keys := jwks.Key(kid)
-	if len(keys) == 0 {
-		return key
-	}
-
-	return keys[0].Key
-}

vendor/gopkg.in/square/go-jose.v2/jwt/validation.go

@@ -1,114 +0,0 @@
-/*-
- * Copyright 2016 Zbigniew Mandziejewicz
- * Copyright 2016 Square, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package jwt
-
-import "time"
-
-const (
-	// DefaultLeeway defines the default leeway for matching NotBefore/Expiry claims.
-	DefaultLeeway = 1.0 * time.Minute
-)
-
-// Expected defines values used for protected claims validation.
-// If field has zero value then validation is skipped.
-type Expected struct {
-	// Issuer matches the "iss" claim exactly.
-	Issuer string
-	// Subject matches the "sub" claim exactly.
-	Subject string
-	// Audience matches the values in "aud" claim, regardless of their order.
-	Audience Audience
-	// ID matches the "jti" claim exactly.
-	ID string
-	// Time matches the "exp", "nbf" and "iat" claims with leeway.
-	Time time.Time
-}
-
-// WithTime copies expectations with new time.
-func (e Expected) WithTime(t time.Time) Expected {
-	e.Time = t
-	return e
-}
-
-// Validate checks claims in a token against expected values.
-// A default leeway value of one minute is used to compare time values.
-//
-// The default leeway will cause the token to be deemed valid until one
-// minute after the expiration time. If you're a server application that
-// wants to give an extra minute to client tokens, use this
-// function. If you're a client application wondering if the server
-// will accept your token, use ValidateWithLeeway with a leeway <=0,
-// otherwise this function might make you think a token is valid when
-// it is not.
-func (c Claims) Validate(e Expected) error {
-	return c.ValidateWithLeeway(e, DefaultLeeway)
-}
-
-// ValidateWithLeeway checks claims in a token against expected values. A
-// custom leeway may be specified for comparing time values. You may pass a
-// zero value to check time values with no leeway, but you should not that
-// numeric date values are rounded to the nearest second and sub-second
-// precision is not supported.
-//
-// The leeway gives some extra time to the token from the server's
-// point of view. That is, if the token is expired, ValidateWithLeeway
-// will still accept the token for 'leeway' amount of time. This fails
-// if you're using this function to check if a server will accept your
-// token, because it will think the token is valid even after it
-// expires. So if you're a client validating if the token is valid to
-// be submitted to a server, use leeway <=0, if you're a server
-// validation a token, use leeway >=0.
-func (c Claims) ValidateWithLeeway(e Expected, leeway time.Duration) error {
-	if e.Issuer != "" && e.Issuer != c.Issuer {
-		return ErrInvalidIssuer
-	}
-
-	if e.Subject != "" && e.Subject != c.Subject {
-		return ErrInvalidSubject
-	}
-
-	if e.ID != "" && e.ID != c.ID {
-		return ErrInvalidID
-	}
-
-	if len(e.Audience) != 0 {
-		for _, v := range e.Audience {
-			if !c.Audience.Contains(v) {
-				return ErrInvalidAudience
-			}
-		}
-	}
-
-	if !e.Time.IsZero() {
-		if c.NotBefore != nil && e.Time.Add(leeway).Before(c.NotBefore.Time()) {
-			return ErrNotValidYet
-		}
-
-		if c.Expiry != nil && e.Time.Add(-leeway).After(c.Expiry.Time()) {
-			return ErrExpired
-		}
-
-		// IssuedAt is optional but cannot be in the future. This is not required by the RFC, but
-		// something is misconfigured if this happens and we should not trust it.
-		if c.IssuedAt != nil && e.Time.Add(leeway).Before(c.IssuedAt.Time()) {
-			return ErrIssuedInTheFuture
-		}
-	}
-
-	return nil
-}

vendor/gopkg.in/square/go-jose.v2/opaque.go

@@ -17,7 +17,7 @@
 package jose
 
 // OpaqueSigner is an interface that supports signing payloads with opaque
-// private key(s). Private key operations performed by implementers may, for
+// private key(s). Private key operations preformed by implementors may, for
 // example, occur in a hardware module. An OpaqueSigner may rotate signing keys
 // transparently to the user of this interface.
 type OpaqueSigner interface {

vendor/gopkg.in/square/go-jose.v2/shared.go

@@ -183,7 +183,7 @@ type Header struct {
 	// Unverified certificate chain parsed from x5c header.
 	certificates []*x509.Certificate
 
-	// Any headers not recognised above get unmarshalled
+	// Any headers not recognised above get unmarshaled
 	// from JSON in a generic manner and placed in this map.
 	ExtraHeaders map[HeaderKey]interface{}
 }
@@ -295,12 +295,12 @@ func (parsed rawHeader) getAPV() (*byteBuffer, error) {
 	return parsed.getByteBuffer(headerAPV)
 }
 
-// getIV extracts parsed "iv" from the raw JSON.
+// getIV extracts parsed "iv" frpom the raw JSON.
 func (parsed rawHeader) getIV() (*byteBuffer, error) {
 	return parsed.getByteBuffer(headerIV)
 }
 
-// getTag extracts parsed "tag" from the raw JSON.
+// getTag extracts parsed "tag" frpom the raw JSON.
 func (parsed rawHeader) getTag() (*byteBuffer, error) {
 	return parsed.getByteBuffer(headerTag)
 }

vendor/gopkg.in/square/go-jose.v2/signing.go

@@ -370,11 +370,7 @@ func (obj JSONWebSignature) DetachedVerify(payload []byte, verificationKey inter
 		}
 	}
 
-	input, err := obj.computeAuthData(payload, &signature)
-	if err != nil {
-		return ErrCryptoFailure
-	}
-
+	input := obj.computeAuthData(payload, &signature)
 	alg := headers.getSignatureAlgorithm()
 	err = verifier.verifyPayload(input, signature.Signature, alg)
 	if err == nil {
@@ -425,11 +421,7 @@ outer:
 			}
 		}
 
-		input, err := obj.computeAuthData(payload, &signature)
-		if err != nil {
-			continue
-		}
-
+		input := obj.computeAuthData(payload, &signature)
 		alg := headers.getSignatureAlgorithm()
 		err = verifier.verifyPayload(input, signature.Signature, alg)
 		if err == nil {