Skip to content

Support CWT text claims and configurable signing hashes - #215

Merged
Shawn Z. (NN2000X) merged 2 commits into
mainfrom
user/cwt-claims-certificate-hash
Sep 22, 2026
Merged

Support CWT text claims and configurable signing hashes#215
Shawn Z. (NN2000X) merged 2 commits into
mainfrom
user/cwt-claims-certificate-hash

Conversation

@JeromySt

@JeromySt Jeromy Statia [MSFT] (JeromySt) commented Sep 21, 2026

Copy link
Copy Markdown
Member

Summary

  • support RFC 9597 CWT Claims maps containing both integer and text-string claim labels
  • add factory-level SHA-256, SHA-384, and SHA-512 signing policy while preserving existing provider APIs
  • expose optional provider hash capabilities through ISupportsHashAlgorithms
  • wire configurable signing hashes through both CoseSignTool sign and indirect-sign
  • remove the fragile Azure.Identity extern alias from the MST plugin

Regression coverage

  • text-labeled CWT claim parsing, preservation, and CBOR round trips
  • protected-header extraction with standard integer claims and "svn": 1
  • certificate-backed PS512 creation and detached verification
  • provider capability rejection for unsupported algorithms
  • direct CLI PS512 signing and verification
  • indirect CLI PS256, PS384, and PS512 algorithm identifiers

Validation

  • full managed solution: 1,141 passed, 5 skipped, 0 failed
  • certificate suites: 146 passed and 60 passed
  • code review completed with no remaining findings

Fixes #213
Fixes #214

@Jstatia
Add CWT text claims and configurable signing hashes
2ea980e 
Support RFC 9597 text-labeled CWT claims and select SHA-256, SHA-384, or SHA-512 through the message factory, direct CLI signing, and indirect signing. Preserve provider API compatibility and advertise optional hash capabilities.

Refs #213 and #214

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-advanced-security[bot]
github-advanced-security Bot found potential problems Sep 21, 2026
View reviewed changes
Comment thread CoseSignTool.MST.Plugin.Tests/MstPluginTests.cs Fixed
@Jstatia
Fix reflected credential exception check
8bb0ded 
Use Type.IsInstanceOfType for the Azure.Identity exception loaded through reflection so CodeQL can validate the class comparison.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@NN2000X
Shawn Z. (NN2000X) merged commit a965dee into main Sep 22, 2026
11 checks passed
@NN2000X
Shawn Z. (NN2000X) deleted the user/cwt-claims-certificate-hash branch September 22, 2026 16:41
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@NN2000X Shawn Z. (NN2000X) NN2000X approved these changes
@elantiguamsft elantiguamsft elantiguamsft approved these changes
+1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@JeromySt Jeromy Statia [MSFT] (JeromySt)

Labels

None yet

Projects

None yet

Milestone

No milestone

5 participants

@JeromySt @github-advanced-security @NN2000X @elantiguamsft @Jstatia