chore: upgrade go-jose to v4 and update JWT serialization methods

Signed-off-by: Chiman Jain <chimanjain15@gmail.com>

Author: chimanjain

cmd/clairctl/main.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"runtime/debug"
 
-	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/go-jose/go-jose/v4/jwt"
 	"github.com/quay/clair/config"
 	_ "github.com/quay/claircore/updater/defaults"
 	"github.com/urfave/cli/v2"

cmd/testdata/ComplexYAML/config.yaml

@@ -10,7 +10,7 @@ updaters:
     - alpine
 auth:
   psk:
-    key: 'c2VjcmV0'
+    key: 'c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U='
     iss:
       - quay
       - clairctl

cmd/testdata/ComplexYAML/want.json

@@ -10,7 +10,7 @@
   },
   "auth": {
     "psk": {
-      "key": "c2VjcmV0",
+      "key": "c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U=",
       "iss": [
         "quay",
         "clairctl"

cmd/testdata/SimpleYAML/config.yaml

@@ -10,7 +10,7 @@ updaters:
     - alpine
 auth:
   psk:
-    key: 'c2VjcmV0'
+    key: 'c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U='
     iss:
       - quay
       - clairctl

cmd/testdata/SimpleYAML/want.json

@@ -12,7 +12,7 @@
   },
   "auth": {
     "psk": {
-      "key": "c2VjcmV0",
+      "key": "c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U=",
       "iss": [
         "quay",
         "clairctl"

config/auth.go

@@ -86,6 +86,11 @@ func (a *AuthPSK) validate(_ Mode) ([]Warning, error) {
 			msg: "key is empty",
 		}
 	}
+	if len(a.Key) < 32 {
+		return nil, &Warning{
+			msg:  "key is too short: must be at least 32 bytes",
+		}
+	}
 	if len(a.Issuer) == 0 {
 		return nil, &Warning{
 			path: ".iss",

config/config_test.go

@@ -39,6 +39,17 @@ func TestValidateFailure(t *testing.T) {
 		}
 	}
 
+	expectError := func(want string) func(*testing.T, *config.Config, error) {
+		return func(t *testing.T, _ *config.Config, err error) {
+			if err == nil {
+				t.Fatal("unexpected success")
+			}
+			if got := err.Error(); got != want {
+				t.Errorf("got error %q, want %q", got, want)
+			}
+		}
+	}
+
 	// Tests on the base Config struct.
 	tt := []ValidateTestcase{
 		{
@@ -90,19 +101,32 @@ func TestValidateFailure(t *testing.T) {
 						PSK: &config.AuthPSK{},
 					},
 				},
-				Check: shouldFail,
+				Check: expectError("key is empty (at )"),
+			},
+			{
+				Name: "BadPSKKeyLen",
+				Conf: config.Config{
+					Mode: config.IndexerMode,
+					Auth: config.Auth{
+						PSK: &config.AuthPSK{
+							Key:    config.Base64([]byte{0xde, 0xad, 0xbe, 0xef}),
+							Issuer: []string{"iss"},
+						},
+					},
+				},
+				Check: expectError("key is too short: must be at least 32 bytes (at )"),
 			},
 			{
 				Name: "BadPSKIssuer",
 				Conf: config.Config{
 					Mode: config.IndexerMode,
 					Auth: config.Auth{
 						PSK: &config.AuthPSK{
-							Key: config.Base64([]byte{0xde, 0xad, 0xbe, 0xef}),
+							Key: config.Base64([]byte("deadbeefdeadbeefdeadbeefdeadbeef")),
 						},
 					},
 				},
-				Check: shouldFail,
+				Check: expectError("no issuers defined (at .iss)"),
 			},
 		}
 		for _, tc := range tt {

contrib/cmd/quaybackstop/clair.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/quay/clair/v4/cmd"
 
-	"github.com/go-jose/go-jose/v3"
+	"github.com/go-jose/go-jose/v4"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/quay/clair/config"

contrib/cmd/quaybackstop/main.go

@@ -34,8 +34,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/go-jose/go-jose/v3"
-	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/quay/clair/config"
 )
@@ -291,7 +291,7 @@ func (a *App) NewRequestWithContext(ctx context.Context, method string, url *url
 		cl.NotBefore = jwt.NewNumericDate(now.Add(-jwt.DefaultLeeway))
 		a.clairTokenResign = now.Add(15 * time.Minute)
 		cl.Expiry = jwt.NewNumericDate(a.clairTokenResign)
-		tok, err := jwt.Signed(a.jwtSigner).Claims(&cl).CompactSerialize()
+		tok, err := jwt.Signed(a.jwtSigner).Claims(&cl).Serialize()
 		if err != nil {
 			return nil, fmt.Errorf("jwt construction: %w", err)
 		}

docker-compose.yaml

@@ -172,7 +172,7 @@ services:
       - ./notifier/webhook/cmd/webhookd
       - -D
       - -key
-      - c2VjcmV0
+      - c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U=
   rabbitmq:
     # This provides STOMP and AMQP on the usual ports.
     # The web UI is available on /rabbitmq