Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-joserfc for openSUSE:Factory checked in at 2026-07-02 20:09:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-joserfc (Old) and /work/SRC/openSUSE:Factory/.python-joserfc.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-joserfc" Thu Jul 2 20:09:53 2026 rev:10 rq:1363024 version:1.7.2 Changes: -------- --- /work/SRC/openSUSE:Factory/python-joserfc/python-joserfc.changes 2026-06-19 17:21:43.126781653 +0200 +++ /work/SRC/openSUSE:Factory/.python-joserfc.new.1982/python-joserfc.changes 2026-07-02 20:13:03.652885129 +0200 @@ -1,0 +2,6 @@ +Wed Jul 1 16:04:31 UTC 2026 - Dirk Müller <[email protected]> + +- update to 1.7.2: + * Avoid trailing padding for JWTs. + +------------------------------------------------------------------- Old: ---- joserfc-1.7.1.tar.gz New: ---- joserfc-1.7.2.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-joserfc.spec ++++++ --- /var/tmp/diff_new_pack.Q5BHft/_old 2026-07-02 20:13:04.712921827 +0200 +++ /var/tmp/diff_new_pack.Q5BHft/_new 2026-07-02 20:13:04.716921966 +0200 @@ -18,7 +18,7 @@ %{?sle15_python_module_pythons} Name: python-joserfc -Version: 1.7.1 +Version: 1.7.2 Release: 0 Summary: The ultimate Python library for JOSE RFCs License: BSD-3-Clause ++++++ joserfc-1.7.1.tar.gz -> joserfc-1.7.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/PKG-INFO new/joserfc-1.7.2/PKG-INFO --- old/joserfc-1.7.1/PKG-INFO 2026-06-08 09:21:04.748734200 +0200 +++ new/joserfc-1.7.2/PKG-INFO 2026-06-29 11:02:44.131009000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: joserfc -Version: 1.7.1 +Version: 1.7.2 Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT Author-email: Hsiaoming Yang <[email protected]> License: BSD-3-Clause diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/docs/changelog.rst new/joserfc-1.7.2/docs/changelog.rst --- old/joserfc-1.7.1/docs/changelog.rst 2026-06-08 09:20:59.000000000 +0200 +++ new/joserfc-1.7.2/docs/changelog.rst 2026-06-29 11:02:40.000000000 +0200 @@ -12,6 +12,13 @@ .. module:: joserfc :noindex: +1.7.2 +----- + +**Released on June 29, 2026** + +- Avoid trailing padding for JWTs. + 1.7.1 ----- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/src/joserfc/__init__.py new/joserfc-1.7.2/src/joserfc/__init__.py --- old/joserfc-1.7.1/src/joserfc/__init__.py 2026-06-08 09:20:59.000000000 +0200 +++ new/joserfc-1.7.2/src/joserfc/__init__.py 2026-06-29 11:02:40.000000000 +0200 @@ -1,4 +1,4 @@ -__version__ = "1.7.1" +__version__ = "1.7.2" __homepage__ = "https://jose.authlib.org/en/"; __author__ = "Hsiaoming Yang <[email protected]>" __license__ = "BSD-3-Clause" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/src/joserfc/util.py new/joserfc-1.7.2/src/joserfc/util.py --- old/joserfc-1.7.1/src/joserfc/util.py 2026-06-08 09:20:59.000000000 +0200 +++ new/joserfc-1.7.2/src/joserfc/util.py 2026-06-29 11:02:40.000000000 +0200 @@ -22,7 +22,7 @@ def urlsafe_b64decode(s: bytes) -> bytes: - if b"+" in s or b"/" in s: + if b"+" in s or b"/" in s or b"=" in s: raise binascii.Error pad = -len(s) % 4 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/src/joserfc.egg-info/PKG-INFO new/joserfc-1.7.2/src/joserfc.egg-info/PKG-INFO --- old/joserfc-1.7.1/src/joserfc.egg-info/PKG-INFO 2026-06-08 09:21:04.000000000 +0200 +++ new/joserfc-1.7.2/src/joserfc.egg-info/PKG-INFO 2026-06-29 11:02:44.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: joserfc -Version: 1.7.1 +Version: 1.7.2 Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT Author-email: Hsiaoming Yang <[email protected]> License: BSD-3-Clause diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/tests/jws/test_compact.py new/joserfc-1.7.2/tests/jws/test_compact.py --- old/joserfc-1.7.1/tests/jws/test_compact.py 2026-06-08 09:20:59.000000000 +0200 +++ new/joserfc-1.7.2/tests/jws/test_compact.py 2026-06-29 11:02:40.000000000 +0200 @@ -33,6 +33,10 @@ value = b"eyJhbGciOiJIUzI1NiJ9.Zm9v.0pehoi-RMZM1jl-4TP_C4Y6BJ-bcmsuzfDyQpkpJkh0" self.assertRaises(BadSignatureError, deserialize_compact, value, key) + def test_reject_padded_signature(self): + value = serialize_compact({"alg": "HS256"}, b"foo", self.key) + self.assertRaises(BadSignatureError, deserialize_compact, value + "=", self.key) + def test_raise_unsupported_algorithm_error(self): self.assertRaises(UnsupportedAlgorithmError, serialize_compact, {"alg": "HS512"}, b"foo", self.key) self.assertRaises(UnsupportedAlgorithmError, serialize_compact, {"alg": "NOT"}, b"foo", self.key) @@ -118,6 +122,7 @@ empty_key = OctKey.import_key("rfc") empty_key._raw_value = b"" from joserfc._rfc7518.jws_algs import HMACAlgorithm + alg = HMACAlgorithm(256) self.assertRaisesRegex(ValueError, "must not be empty", alg.sign, b"msg", empty_key) self.assertRaisesRegex(ValueError, "must not be empty", alg.verify, b"msg", b"sig", empty_key) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.1/tests/test_util.py new/joserfc-1.7.2/tests/test_util.py --- old/joserfc-1.7.1/tests/test_util.py 2026-06-08 09:20:59.000000000 +0200 +++ new/joserfc-1.7.2/tests/test_util.py 2026-06-29 11:02:40.000000000 +0200 @@ -21,6 +21,9 @@ def test_urlsafe_b64decode(self): self.assertEqual(util.urlsafe_b64decode(b"_foo123-"), b"\xfd\xfa(\xd7m\xfe") self.assertRaises(binascii.Error, util.urlsafe_b64decode, b"+foo123/") + self.assertRaises(binascii.Error, util.urlsafe_b64decode, b"QQ==") + self.assertRaises(binascii.Error, util.urlsafe_b64decode, b"QUI=") + self.assertRaises(binascii.Error, util.urlsafe_b64decode, b"QUJD=") for c in "RSTUVWXYZabdef": # A -> QQ== self.assertRaises(binascii.Error, util.urlsafe_b64decode, b"Q" + c.encode()) for c in "FGH": # AAAAAAAAAAAAAA -> QUFBQUFBQUFBQUFBQUE=
