Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-joserfc for openSUSE:Factory checked in at 2026-07-15 16:43:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-joserfc (Old) and /work/SRC/openSUSE:Factory/.python-joserfc.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-joserfc" Wed Jul 15 16:43:39 2026 rev:12 rq:1365767 version:1.7.3 Changes: -------- --- /work/SRC/openSUSE:Factory/python-joserfc/python-joserfc.changes 2026-07-03 16:11:58.935984500 +0200 +++ /work/SRC/openSUSE:Factory/.python-joserfc.new.1991/python-joserfc.changes 2026-07-15 17:01:34.955069565 +0200 @@ -1,0 +2,7 @@ +Tue Jul 14 20:12:19 UTC 2026 - Dirk Müller <[email protected]> + +- update to 1.7.3: + * Add default claims validation for iss, sub and aud. + * Add size validation even for self-provided payload. + +------------------------------------------------------------------- Old: ---- joserfc-1.7.2.tar.gz New: ---- joserfc-1.7.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-joserfc.spec ++++++ --- /var/tmp/diff_new_pack.OcWrtO/_old 2026-07-15 17:01:36.011105431 +0200 +++ /var/tmp/diff_new_pack.OcWrtO/_new 2026-07-15 17:01:36.015105567 +0200 @@ -18,7 +18,7 @@ %{?sle15_python_module_pythons} Name: python-joserfc -Version: 1.7.2 +Version: 1.7.3 Release: 0 Summary: The ultimate Python library for JOSE RFCs License: BSD-3-Clause ++++++ joserfc-1.7.2.tar.gz -> joserfc-1.7.3.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/PKG-INFO new/joserfc-1.7.3/PKG-INFO --- old/joserfc-1.7.2/PKG-INFO 2026-06-29 11:02:44.131009000 +0200 +++ new/joserfc-1.7.3/PKG-INFO 2026-07-08 14:41:20.949653900 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: joserfc -Version: 1.7.2 +Version: 1.7.3 Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT Author-email: Hsiaoming Yang <[email protected]> License: BSD-3-Clause diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/docs/changelog.rst new/joserfc-1.7.3/docs/changelog.rst --- old/joserfc-1.7.2/docs/changelog.rst 2026-06-29 11:02:40.000000000 +0200 +++ new/joserfc-1.7.3/docs/changelog.rst 2026-07-08 14:41:16.000000000 +0200 @@ -12,6 +12,14 @@ .. module:: joserfc :noindex: +1.7.3 +----- + +**Released on July 8, 2026** + +- Add default claims validation for ``iss``, ``sub`` and ``aud``. +- Add size validation even for self-provided payload. + 1.7.2 ----- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/docs/conf.py new/joserfc-1.7.3/docs/conf.py --- old/joserfc-1.7.2/docs/conf.py 2026-06-29 11:02:40.000000000 +0200 +++ new/joserfc-1.7.3/docs/conf.py 2026-07-08 14:41:16.000000000 +0200 @@ -51,9 +51,7 @@ "accent_color": "blue", "light_logo": "_static/light-logo.svg", "dark_logo": "_static/dark-logo.svg", - "twitter_site": "authlib", - "twitter_creator": "lepture", - "twitter_url": "https://twitter.com/authlib";, + "x_url": "https://x.com/authlib";, "github_url": "https://github.com/authlib/joserfc";, "discord_url": "https://discord.gg/HvBVAeNAaV";, "carbon_ads_code": "CE7DKK3W", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/src/joserfc/__init__.py new/joserfc-1.7.3/src/joserfc/__init__.py --- old/joserfc-1.7.2/src/joserfc/__init__.py 2026-06-29 11:02:40.000000000 +0200 +++ new/joserfc-1.7.3/src/joserfc/__init__.py 2026-07-08 14:41:16.000000000 +0200 @@ -1,4 +1,4 @@ -__version__ = "1.7.2" +__version__ = "1.7.3" __homepage__ = "https://jose.authlib.org/en/"; __author__ = "Hsiaoming Yang <[email protected]>" __license__ = "BSD-3-Clause" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/src/joserfc/_rfc7519/claims.py new/joserfc-1.7.3/src/joserfc/_rfc7519/claims.py --- old/joserfc-1.7.2/src/joserfc/_rfc7519/claims.py 2026-06-29 11:02:40.000000000 +0200 +++ new/joserfc-1.7.3/src/joserfc/_rfc7519/claims.py 2026-07-08 14:41:16.000000000 +0200 @@ -120,6 +120,49 @@ return self._now() return self._now + def validate_iss(self, value: str) -> None: + """The "iss" (issuer) claim identifies the principal that issued the + JWT. The processing of this claim is generally application specific. + The "iss" value is a case-sensitive string containing a StringOrURI + value. Use of this claim is OPTIONAL. + """ + if not isinstance(value, str): + raise InvalidClaimError("str", "Claim 'str' must be a StringOrURI value") + self.check_value("iss", value) + + def validate_sub(self, value: str) -> None: + """The "sub" (subject) claim identifies the principal that is the + subject of the JWT. The claims in a JWT are normally statements + about the subject. The subject value MUST either be scoped to be + locally unique in the context of the issuer or be globally unique. + The processing of this claim is generally application specific. The + "sub" value is a case-sensitive string containing a StringOrURI + value. Use of this claim is OPTIONAL. + """ + if not isinstance(value, str): + raise InvalidClaimError("sub", "Claim 'sub' must be a StringOrURI value") + self.check_value("sub", value) + + def validate_aud(self, value: str | list[str]) -> None: + """The "aud" (audience) claim identifies the recipients that the JWT is + intended for. Each principal intended to process the JWT MUST + identify itself with a value in the audience claim. If the principal + processing the claim does not identify itself with a value in the + "aud" claim when this claim is present, then the JWT MUST be + rejected. In the general case, the "aud" value is an array of case- + sensitive strings, each containing a StringOrURI value. In the + special case when the JWT has one audience, the "aud" value MAY be a + single case-sensitive string containing a StringOrURI value. The + interpretation of audience values is generally application specific. + Use of this claim is OPTIONAL. + """ + if isinstance(value, str) or _validate_list_of_strings(value): + self.check_value("aud", value) + else: + raise InvalidClaimError( + "aud", "Claim 'aud' must be an array of StringOrURI value or a single StringOrURI value" + ) + def validate_exp(self, value: int) -> None: """The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. The @@ -167,5 +210,9 @@ return isinstance(s, (int, float)) +def _validate_list_of_strings(s: list[str]) -> bool: + return isinstance(s, list) and all(isinstance(v, str) for v in s) + + def _generate_now() -> int: return int(time.time()) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/src/joserfc/_rfc7797/compact.py new/joserfc-1.7.3/src/joserfc/_rfc7797/compact.py --- old/joserfc-1.7.2/src/joserfc/_rfc7797/compact.py 2026-06-29 11:02:40.000000000 +0200 +++ new/joserfc-1.7.3/src/joserfc/_rfc7797/compact.py 2026-07-08 14:41:16.000000000 +0200 @@ -56,6 +56,7 @@ if is_rfc7797_enabled(protected): if not payload_segment and payload: payload_segment = to_bytes(payload) + registry.validate_payload_size(payload_segment) payload = payload_segment else: if not payload_segment and payload: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/src/joserfc.egg-info/PKG-INFO new/joserfc-1.7.3/src/joserfc.egg-info/PKG-INFO --- old/joserfc-1.7.2/src/joserfc.egg-info/PKG-INFO 2026-06-29 11:02:44.000000000 +0200 +++ new/joserfc-1.7.3/src/joserfc.egg-info/PKG-INFO 2026-07-08 14:41:20.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: joserfc -Version: 1.7.2 +Version: 1.7.3 Summary: The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT Author-email: Hsiaoming Yang <[email protected]> License: BSD-3-Clause diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/joserfc-1.7.2/tests/jwt/test_claims.py new/joserfc-1.7.3/tests/jwt/test_claims.py --- old/joserfc-1.7.2/tests/jwt/test_claims.py 2026-06-29 11:02:40.000000000 +0200 +++ new/joserfc-1.7.3/tests/jwt/test_claims.py 2026-07-08 14:41:16.000000000 +0200 @@ -48,6 +48,30 @@ claims_requests.validate({"sub": "a", "iss": "a", "name": "joserfc"}) + def test_claim_iss(self): + claims_requests = jwt.JWTClaimsRegistry(iss={"essential": True}) + claims_requests.validate({"iss": "a"}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"iss": 1}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"iss": True}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"iss": ["a"]}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"iss": {"a": "b"}}) + + def test_claim_sub(self): + claims_requests = jwt.JWTClaimsRegistry(sub={"essential": True}) + claims_requests.validate({"sub": "a"}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": 1}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": True}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": ["a"]}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": {"a": "b"}}) + + def test_claim_aud(self): + claims_requests = jwt.JWTClaimsRegistry(aud={"essential": True}) + claims_requests.validate({"aud": "a"}) + claims_requests.validate({"aud": ["a"]}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"aud": 1}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"aud": True}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"aud": {"a": "b"}}) + def test_essential_empty_value(self): claims_requests = jwt.JWTClaimsRegistry(sub={"essential": True}) self.assertRaises(MissingClaimError, claims_requests.validate, {"sub": None}) @@ -62,23 +86,23 @@ claims_requests.validate({"foo": 0}) def test_option_value(self): - claims_requests = jwt.JWTClaimsRegistry(sub={"essential": True, "value": "123"}) - self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": "a"}) - claims_requests.validate({"sub": "123"}) - claims_requests = jwt.JWTClaimsRegistry(sub={"essential": True, "value": True}) - claims_requests.validate({"sub": True}) - self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": False}) - claims_requests = jwt.JWTClaimsRegistry(sub={"essential": True, "value": False}) - claims_requests.validate({"sub": False}) - self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": True}) + claims_requests = jwt.JWTClaimsRegistry(foo={"essential": True, "value": "123"}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"foo": "a"}) + claims_requests.validate({"foo": "123"}) + claims_requests = jwt.JWTClaimsRegistry(foo={"essential": True, "value": True}) + claims_requests.validate({"foo": True}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"foo": False}) + claims_requests = jwt.JWTClaimsRegistry(foo={"essential": True, "value": False}) + claims_requests.validate({"foo": False}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"foo": True}) def test_option_values(self): - claims_requests = jwt.JWTClaimsRegistry(sub={"essential": True, "values": ["1", "2", True, False]}) - self.assertRaises(InvalidClaimError, claims_requests.validate, {"sub": "a"}) - claims_requests.validate({"sub": "1"}) - claims_requests.validate({"sub": "2"}) - claims_requests.validate({"sub": True}) - claims_requests.validate({"sub": False}) + claims_requests = jwt.JWTClaimsRegistry(foo={"essential": True, "values": ["1", "2", True, False]}) + self.assertRaises(InvalidClaimError, claims_requests.validate, {"foo": "a"}) + claims_requests.validate({"foo": "1"}) + claims_requests.validate({"foo": "2"}) + claims_requests.validate({"foo": True}) + claims_requests.validate({"foo": False}) def test_int_claims(self): now = int(time.time())
