fix: harden JWS constructors and bump golangci-lint for Go 1.27

Reject key/alg mismatches at NewJWS* construction, document SetAllowedAlgs vs foreign JWS, and move lint to v2.13.1 so CI can target go.mod 1.27.0. Track upstream jwx ECDSA/ML-DSA AlgorithmsForKey gaps for later.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yaronf

.github/workflows/lint.yml

@@ -16,4 +16,5 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.12.2
+          # v2.13+ is built with Go 1.27 (v2.12.x was go1.26 and rejects go.mod 1.27.0)
+          version: v2.13.1

config.go

@@ -184,9 +184,11 @@ func (v *VerifyConfig) SetRejectExpired(rejectExpired bool) *VerifyConfig {
 	return v
 }
 
-// SetAllowedAlgs defines the allowed values of the "alg" parameter.
-// This is useful if the actual algorithm used in verification is taken from the message - not a recommended practice.
-// Default: an empty list, signifying all values are accepted.
+// SetAllowedAlgs defines the allowed values of the HTTP Message Signatures "alg" parameter
+// (RFC 9421), not the JWS algorithm passed to NewJWSSigner/NewJWSVerifier.
+// This is useful if the algorithm used in verification is taken from the message — not a recommended practice.
+// With foreign JWS signers the library refuses to emit "alg", so this policy only applies when a peer
+// still includes that parameter. Default: an empty list, signifying all values are accepted.
 func (v *VerifyConfig) SetAllowedAlgs(allowedAlgs []string) *VerifyConfig {
 	v.allowedAlgs = allowedAlgs
 	return v

crypto.go

@@ -12,6 +12,7 @@ import (
 	"crypto/sha512"
 	"crypto/subtle"
 	"fmt"
+	"slices"
 
 	"github.com/lestrrat-go/jwx/v4/jwa"
 	"github.com/lestrrat-go/jwx/v4/jws"
@@ -128,14 +129,22 @@ func NewEd25519SignerFromSeed(seed []byte, config *SignConfig, fields Fields) (*
 
 // NewJWSSigner creates a generic signer for JWS algorithms via github.com/lestrrat-go/jwx/v4.
 // The particular key type for each algorithm is documented in that package (including
-// crypto/mldsa keys for ML-DSA on Go 1.27+). Config may be nil for a default configuration.
+// crypto/mldsa keys for ML-DSA on Go 1.27+). HMAC keys must be []byte (not string).
+// Config may be nil for a default configuration.
+//
+// Note: foreign JWS signers do not emit the HTTP Message Signatures "alg" parameter
+// (see SignConfig.SignAlg). VerifyConfig.SetAllowedAlgs therefore only applies if a peer
+// still includes that parameter; it does not constrain the JWS algorithm passed here.
 func NewJWSSigner(alg jwa.SignatureAlgorithm, key interface{}, config *SignConfig, fields Fields) (*Signer, error) {
 	if key == nil {
 		return nil, fmt.Errorf("key must not be nil")
 	}
 	if alg == jwa.NoSignature() {
 		return nil, fmt.Errorf("the NONE signing algorithm is expressly disallowed")
 	}
+	if err := validateJWSKeyAlg(alg, key); err != nil {
+		return nil, err
+	}
 	if config == nil {
 		config = NewSignConfig()
 	}
@@ -152,6 +161,20 @@ func NewJWSSigner(alg jwa.SignatureAlgorithm, key interface{}, config *SignConfi
 	}, nil
 }
 
+// validateJWSKeyAlg rejects keys that jwx does not associate with alg (wrong key family).
+// It uses jws.AlgorithmsForKey; some families list multiple algs (e.g. all HS*, all ML-DSA*),
+// so finer mismatches may still fail later at Sign/Verify time.
+func validateJWSKeyAlg(alg jwa.SignatureAlgorithm, key interface{}) error {
+	algs, err := jws.AlgorithmsForKey(key)
+	if err != nil {
+		return fmt.Errorf("key is not usable for JWS signing/verification: %w", err)
+	}
+	if !slices.Contains(algs, alg) {
+		return fmt.Errorf("algorithm %s is not valid for key type %T", alg, key)
+	}
+	return nil
+}
+
 func (s Signer) sign(buff []byte) ([]byte, error) {
 	if s.foreignSigner != nil {
 		signer, ok := s.foreignSigner.(jws.Signer)
@@ -325,18 +348,25 @@ func NewEd25519Verifier(key ed25519.PublicKey, config *VerifyConfig, fields Fiel
 
 // NewJWSVerifier creates a generic verifier for JWS algorithms via github.com/lestrrat-go/jwx/v4.
 // The particular key type for each algorithm is documented in that package (including
-// crypto/mldsa keys for ML-DSA on Go 1.27+). Set config to nil for a default configuration.
+// crypto/mldsa keys for ML-DSA on Go 1.27+). HMAC keys must be []byte (not string).
+// Set config to nil for a default configuration.
 // Fields is the list of required headers and fields, which may be empty (but this is typically insecure).
+//
+// Note: SetAllowedAlgs constrains the HTTP Message Signatures "alg" parameter on the wire,
+// not the JWS algorithm passed here. Foreign JWS signers omit that parameter by design.
 func NewJWSVerifier(alg jwa.SignatureAlgorithm, key interface{}, config *VerifyConfig, fields Fields) (*Verifier, error) {
 	if key == nil {
 		return nil, fmt.Errorf("key must not be nil")
 	}
-	if config == nil {
-		config = NewVerifyConfig()
-	}
 	if alg == jwa.NoSignature() {
 		return nil, fmt.Errorf("the NONE signing algorithm is expressly disallowed")
 	}
+	if err := validateJWSKeyAlg(alg, key); err != nil {
+		return nil, err
+	}
+	if config == nil {
+		config = NewVerifyConfig()
+	}
 	verifier, err := jws.VerifierFor(alg)
 	if err != nil {
 		return nil, err

crypto_test.go

@@ -248,7 +248,45 @@ func TestNewRSASigner1(t *testing.T) {
 	}
 }
 
+func TestNewJWSSigner(t *testing.T) {
+	hmacKey := []byte("1234")
+	priv, err := rsa.GenerateKey(rand.Reader, 1024)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		alg     jwa.SignatureAlgorithm
+		key     any
+		wantErr bool
+	}{
+		{name: "happy path", alg: jwa.HS256(), key: hmacKey},
+		{name: "none", alg: jwa.NoSignature(), key: hmacKey, wantErr: true},
+		{name: "nil key", alg: jwa.HS256(), key: nil, wantErr: true},
+		{name: "string hmac key", alg: jwa.HS256(), key: "1234", wantErr: true},
+		{name: "key alg mismatch", alg: jwa.HS256(), key: priv, wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NewJWSSigner(tt.alg, tt.key, nil, *NewFields())
+			if tt.wantErr {
+				require.Error(t, err)
+				require.Nil(t, got)
+				return
+			}
+			require.NoError(t, err)
+			require.NotNil(t, got)
+			require.NotNil(t, got.foreignSigner)
+			assert.Equal(t, hmacKey, got.key)
+			assert.Empty(t, got.alg)
+		})
+	}
+}
+
 func TestNewJWSVerifier(t *testing.T) {
+	hmacKey := []byte("1234")
+	priv, err := rsa.GenerateKey(rand.Reader, 1024)
+	require.NoError(t, err)
+
 	type args struct {
 		alg    jwa.SignatureAlgorithm
 		key    any
@@ -265,12 +303,12 @@ func TestNewJWSVerifier(t *testing.T) {
 			name: "happy path",
 			args: args{
 				alg:    jwa.HS256(),
-				key:    "1234",
+				key:    hmacKey,
 				config: nil,
 				fields: *NewFields(),
 			},
 			want: &Verifier{
-				key:             "1234",
+				key:             hmacKey,
 				alg:             "",
 				config:          NewVerifyConfig(),
 				fields:          *NewFields(),
@@ -282,7 +320,7 @@ func TestNewJWSVerifier(t *testing.T) {
 			name: "none",
 			args: args{
 				alg:    jwa.NoSignature(),
-				key:    "1234",
+				key:    hmacKey,
 				config: NewVerifyConfig(),
 				fields: *NewFields(),
 			},
@@ -300,6 +338,28 @@ func TestNewJWSVerifier(t *testing.T) {
 			want:    nil,
 			wantErr: true,
 		},
+		{
+			name: "string hmac key",
+			args: args{
+				alg:    jwa.HS256(),
+				key:    "1234",
+				config: NewVerifyConfig(),
+				fields: *NewFields(),
+			},
+			want:    nil,
+			wantErr: true,
+		},
+		{
+			name: "key alg mismatch",
+			args: args{
+				alg:    jwa.HS256(),
+				key:    priv.Public(),
+				config: NewVerifyConfig(),
+				fields: *NewFields(),
+			},
+			want:    nil,
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -338,25 +398,38 @@ func TestVerify(t *testing.T) {
 	assert.ErrorContains(t, err, "expected", "bad algorithm")
 }
 
-func TestForeignSignerMLDSA65(t *testing.T) {
-	priv, err := mldsa.GenerateKey(mldsa.MLDSA65())
-	require.NoError(t, err)
-	pub := priv.Public().(*mldsa.PublicKey)
+func TestForeignSignerMLDSA(t *testing.T) {
+	cases := []struct {
+		name   string
+		params mldsa.Parameters
+		alg    jwa.SignatureAlgorithm
+	}{
+		{"MLDSA44", mldsa.MLDSA44(), jwa.MLDSA44()},
+		{"MLDSA65", mldsa.MLDSA65(), jwa.MLDSA65()},
+		{"MLDSA87", mldsa.MLDSA87(), jwa.MLDSA87()},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			priv, err := mldsa.GenerateKey(tc.params)
+			require.NoError(t, err)
+			pub := priv.Public().(*mldsa.PublicKey)
 
-	config := NewSignConfig().setFakeCreated(1618884475).SignAlg(false)
-	signatureName := "sig1"
-	fields := *NewFields().AddHeader("@method").AddHeader("date").AddHeader("content-type").AddQueryParam("pet")
-	signer, err := NewJWSSigner(jwa.MLDSA65(), priv, config.SetKeyID("pq1"), fields)
-	require.NoError(t, err)
+			config := NewSignConfig().setFakeCreated(1618884475).SignAlg(false)
+			signatureName := "sig1"
+			fields := *NewFields().AddHeader("@method").AddHeader("date").AddHeader("content-type").AddQueryParam("pet")
+			signer, err := NewJWSSigner(tc.alg, priv, config.SetKeyID("pq1"), fields)
+			require.NoError(t, err)
 
-	req := readRequest(httpreq2)
-	sigInput, sig, err := SignRequest(signatureName, *signer, req)
-	require.NoError(t, err)
-	req.Header.Add("Signature", sig)
-	req.Header.Add("Signature-Input", sigInput)
+			req := readRequest(httpreq2)
+			sigInput, sig, err := SignRequest(signatureName, *signer, req)
+			require.NoError(t, err)
+			req.Header.Add("Signature", sig)
+			req.Header.Add("Signature-Input", sigInput)
 
-	verifier, err := NewJWSVerifier(jwa.MLDSA65(), pub, NewVerifyConfig().SetVerifyCreated(false).SetKeyID("pq1"), fields)
-	require.NoError(t, err)
-	require.NoError(t, VerifyRequest(signatureName, *verifier, req))
+			verifier, err := NewJWSVerifier(tc.alg, pub, NewVerifyConfig().SetVerifyCreated(false).SetKeyID("pq1"), fields)
+			require.NoError(t, err)
+			require.NoError(t, VerifyRequest(signatureName, *verifier, req))
+		})
+	}
 }
 

internal-docs/JWX.md

@@ -48,7 +48,7 @@ Ship as **`v0.6.0`** when merged. Dual v2+v3 is removed on this branch.
 | `encoding/json/v2` in stdlib (no `GOEXPERIMENT=jsonv2`) | **Met** — see [Go 1.27 notes](https://go.dev/doc/go1.27) |
 | jwx v4 mature | **Met** — pinned **`v4.4.0`** |
 | Smoke / full tests under `GOTOOLCHAIN=go1.27.0` | **Met** on cutover branch |
-| Stdlib **`crypto/mldsa`** + jwx native ML-DSA (PQ goal) | **Met** — `TestForeignSignerMLDSA65` |
+| Stdlib **`crypto/mldsa`** + jwx native ML-DSA (PQ goal) | **Met** — `TestForeignSignerMLDSA` (44/65/87) |
 
 ### Why this was deferred (history)
 
@@ -93,7 +93,8 @@ No change to key types or httpsign `SignConfig` / `VerifyConfig` / `Fields` for
 
 | Item | Requirement |
 |------|-------------|
-| Go | **1.27.0+** in `go.mod` / CI (today CI is still 1.24) |
+| Go | **1.27.0+** in `go.mod` / CI |
+| golangci-lint | **≥ v2.13** (built with Go 1.27; v2.12.x fails with go.mod `1.27.0`) |
 | `GOEXPERIMENT=jsonv2` | Not required; do not set |
 | `GOEXPERIMENT=nojsonv2` | Avoid in CI |
 
@@ -111,12 +112,26 @@ Scoped to httpsign’s use of **jwa** + **jws** only (no JWT/JWE/JWK fetch in li
 - [x] Rewrite imports `jwx/v2|v3` → `jwx/v4`; collapse constructors; update `sign()` / `verify()` dispatch for v4 `jws.Signer` / `jws.Verifier` (renamed from v3 `Signer2` / `Verifier2`; parameter order matches today’s V3 path: key before payload).
 - [x] Confirm factory APIs (`SignerFor` / `VerifierFor`) and `NoSignature` rejection still work.
 - [x] Drop v2↔v3 cross-compat tests; keep round-trip tests on the single v4 path.
-- [x] **PQ:** foreign-JWS round-trip with `crypto/mldsa` + `jwa.MLDSA65()` (and smoke 44/87 if cheap); document in README/release notes.
+- [x] **PQ:** foreign-JWS round-trips with `crypto/mldsa` + `jwa.MLDSA44/65/87()`; document in README/release notes.
 - [ ] Run `jwxmigrate --fix` if helpful; fix remaining compile/test failures by hand. *(done by hand; migrate tool optional)*
 - [x] CI (`test.yml`, `lint.yml`, CodeQL): Go **1.27**; do not set `jsonv2` / `nojsonv2`.
+- [x] Lint: bump **golangci-lint ≥ v2.13** (v2.12.2 is built with go1.26 → fails on go.mod 1.27.0).
 - [x] Docs: README / `CLAUDE.md` / this file — remove dual-version guidance; **`v0.6.0`** release notes with caller steps + PQ; link upstream Changes-v4 if relevant.
+- [x] Hardening: constructor `jws.AlgorithmsForKey` check; reject `NoSignature`; HMAC keys must be `[]byte`; document `SetAllowedAlgs` vs JWS alg.
 - [ ] Tag **`v0.6.0`** and publish. *(after merge)*
 
+### Later action: upstream jwx / dsig (found 2026-08-26 while hardening)
+
+Not blocking `v0.6.0`. File / track upstream issues; optionally tighten httpsign further if upstream stays loose.
+
+| Finding | Severity | Notes |
+|---------|----------|-------|
+| **`jws.AlgorithmsForKey` ignores ECDSA curve** for raw `*ecdsa.{Private,Public}Key` | Correctness | Returns `[ES256, ES384, ES512]` for any EC key. Docs claim curve is inferred from the Go type, but `hasCrv` is never set for stdlib ECDSA; `RegisterAlgorithmForCurve` is only used for Ed25519 in init (no P-256→ES256 etc.). |
+| **ECDSA Sign/Verify do not enforce RFC 7518 curve↔alg** | Spec / footgun | `ES384` effectively means SHA-384 only; a **P-256** key can mint `"alg":"ES384"` and verify with the same P-256 pub (64-byte sig). Will not verify under a real P-384 key. Policy that allows only ES384 expecting P-384 strength can accept weaker P-256+SHA-384 if a P-256 key is registered. dsig examples treat cross-curve as intentional for custom algs. |
+| **`AlgorithmsForKey` lists all ML-DSA algs** for any ML-DSA key | Classifier only | Sign/Verify correctly reject parameter-set mismatch — crypto path is fine; helper is over-broad (same class of bug as ECDSA listing). |
+
+**Suggested upstream asks (lestrrat-go/jwx + dsig):** (1) extract curve from raw ECDSA keys in `AlgorithmsForKey` and register P-256/P-384/P-521 → ES256/ES384/ES512; (2) optionally enforce curve↔alg in ECDSA Sign/Verify; (3) refine ML-DSA listing by parameter set. **httpsign follow-up:** if upstream does not tighten ECDSA, consider our own curve check in `validateJWSKeyAlg` (and ML-DSA `Parameters()` vs `jwa.MLDSA*`).
+
 ### Upstream items likely N/A or low priority
 
 | Topic | httpsign |