-
Notifications
You must be signed in to change notification settings - Fork 1
Fix base64 format for JSON #37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Ken Takayama <[email protected]>
Signed-off-by: Ken Takayama <[email protected]>
…coding/decoding Signed-off-by: Ken Takayama <[email protected]>
14d36ca to
6f45fcf
Compare
…L definition Signed-off-by: Ken Takayama <[email protected]>
|
This PR should be ready for review. @thomas-fossati , could you please take a look when you have time? |
Signed-off-by: Ken Takayama <[email protected]>
| } | ||
|
|
||
| func TestMeasuredComponent_MarshalJSON_OK(t *testing.T) { | ||
| data := []byte(`{"id":["Foo",["1.3.4","multipartnumeric"]],"measurement":[1,"3q2-796tvu_erb7v3q2-796tvu_erb7v3q2-796tvu8"]}`) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One quick check: AFAIR, there is no special encoding for coswid.$version-scheme in the JSON serialisation. I.e., instead of ”multipartnumeric" it should be 1, no?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Exactly.
RFC 9393 states that CoSWID does not define any specific encoding or decoding rules for JSON.
https://datatracker.ietf.org/doc/html/rfc9393#name-the-concise-swid-tag-map
The string "multipartnumeric" comes from the veraison/swid implementation specification:
https://github.com/veraison/swid/blob/main/versionscheme.go#L40-L56
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
OK, thanks for double checking. We will need to fix it in veraison/swid then.
(EDIT: raised veraison/swid#47)
thomas-fossati
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks @kentakayama !
EAT basically uses base64-url-text without '=' padding, except for the nonce-type.
However, Go's
encoding/jsonpackage encodes binary data using standard base64 with padding by default.This PR resolves that mismatch by ensuring base64url encoding without padding is used where required.
As part of this change, the
swid.HashEntryhas been replaced withDigest.The former encodes a hash like
[swid.Sha256, h'0000...']as a string"sha256;AA...=".In contrast, the new
Digesttype encodes it as an array[1,"AA..."]where "AA..." is base64url-encoded without padding.This aligns with the following specifications: