Ruben FiszelandClaude Opus 4.8 f5713621c8 fix: accept any PEM wrapping for the guest key, keep the public-key check ...

The SPKI guard decoded the body with the strict RFC 7468 decoder, which enforces
64-column wrapping, so a legitimate public key wrapped otherwise (or a PKCS#1
`RSA PUBLIC KEY`) was refused where jsonwebtoken would have parsed it. Decode the
body leniently like jsonwebtoken, then require the DER to be a public-key
structure: an SPKI (RSA or EC) or a PKCS#1 RSA public key. Private material
satisfies neither, so the round-13 bypass stays closed. Test adds a one-line
(non-64-column) public key as a positive control.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 10:30:46 +02:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: accept any PEM wrapping for the guest key, keep the public-key check

2026-09-04 10:30:46 +02:00

tests

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

Cargo.toml

fix: accept any PEM wrapping for the guest key, keep the public-key check

2026-09-04 10:30:46 +02:00