[GitHub] [trafficcontrol] zrhoffman commented on a change in pull request #6380: Upgrade github.com/lestrrat-go/jwx to 1.2.12

[GitBox <gi...@apache.org>]

zrhoffman commented on a change in pull request #6380:
URL: https://github.com/apache/trafficcontrol/pull/6380#discussion_r758613598



##########
File path: go.mod
##########
@@ -71,12 +68,26 @@ require (
 
 require github.com/go-ldap/ldap/v3 v3.4.1
 
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.0-20210816181553-5444fa50b93d // indirect
+	github.com/goccy/go-json v0.7.10 // indirect
+	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.0 // indirect
+	github.com/lestrrat-go/httpcc v1.0.0 // indirect
+	github.com/lestrrat-go/iter v1.0.1 // indirect
+	github.com/lestrrat-go/option v1.0.0 // indirect
+)
+
 require (
 	github.com/Azure/go-ntlmssp v0.0.0-20200615164410-66371956d46c // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.1 // indirect
 	github.com/golang/protobuf v1.4.3 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.0 // indirect
+	github.com/lestrrat-go/jwx v1.2.12-0.20211125230033-881a53637884
+	github.com/lestrrat/go-jwx v0.0.0-20210302221443-a9d01c1b7121 // indirect
+	github.com/lestrrat/go-pdebug v0.0.0-20180220043741-569c97477ae8 // indirect

Review comment:
       For me, the `github.com/lestrrat/go-jwx` *require* is removed from `go.mod` when I run `go mod tidy`.
   
   Would you please run `go mod tidy` and `go mod vendor` using Go 1.17 or later and commit the changes made to `go.mod`, `go.sum`, and `vendor/`?

##########
File path: traffic_ops/traffic_ops_golang/urisigning/urisigning.go
##########
@@ -62,7 +63,7 @@ func GetURIsignkeysHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if len(ro) == 0 {
-		ro, err = json.Marshal(tc.URISignerKeyset{})
+		ro, err = json.Marshal(jwk.NewSet())

Review comment:
       For backwards compatibility, when there are no  `urisigning.GetURIsignkeysHandler()` should return
   ```json
   {
       "renewal_kid": null,
       "keys": null
   }
   ```
   
   when there are no URI signing keys (see apache/trafficcontrol#5884).




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org