[Spomky]

Found by the backward compatibility audit of 4.3.x against 4.2.7.

The defect

Up to 4.2, the bundle registered the none and RSA1_5 algorithms as private services whose ids are the library classes, Jose\Component\Signature\Algorithm\None and Jose\Component\Encryption\Algorithm\KeyEncryption\RSA15. In 4.3 the two algorithms moved to web-token/jwt-unsecured and web-token/jwt-rsa15, and the bundle registers the classes of those packages instead. The former ids no longer exist, so the container of an application that used them fails to compile:

• a reference to @Jose\Component\Signature\Algorithm\None: ServiceNotFoundException;
• a service that autowires the library None or RSA15 class: Cannot autowire service.

The fix

The former ids are registered again as deprecated services without the jose.algorithm tag, as was done for the experimental ES256K:

• aliases: none and RSA1_5 are still served by Jose\Unsecured\Signature\None and Jose\Rsa15\KeyEncryption\RSA15.
• why not an alias to the new services: the library classes extend the new ones, so a service autowired with the library class would receive an instance of the parent class and fail with a TypeError.
• deprecations: using a former id triggers the deprecation of the service, then the one the library class already triggers. For example: The "Jose\Component\Signature\Algorithm\None" service is deprecated and will be removed in 5.0.0: the "none" algorithm is now shipped by the "web-token/jwt-unsecured" package and registered as "Jose\Unsecured\Signature\None", under the same "none" alias.
• applications that do not use the former ids: nothing changes for them, since unused private services are removed from the container.

Both services are removed in 5.0.0, together with the library classes.

Verification

• UnsecuredAlgorithmTest and Rsa15AlgorithmTest check two things:

  • the alias is served by the exact class of the new package;
  • a test service autowired with the library class receives it, with the two deprecations.

• Probes with a kernel and an application service, on 4.2.7, on 4.3.x and on this branch:

  	4.2.7	4.3.x	this branch
  reference to the former id	works	ServiceNotFoundException	works
  autowiring of the library class	works	Cannot autowire service	works, 2 deprecations

• Compiled container compared with 4.2.7: the two ids are back, deprecated and without the tag, and nothing else changes.

• Full suite with phpunit-11 in phpqa:8.4: 2,960 tests, no failure. The 4 skipped and 2 incomplete tests are the ML-DSA and PKCS#12 platform tests.

• PHPStan is clean apart from two classConstant.deprecatedClass entries added to the baseline, like the one of signature_experimental.php. ECS, Rector and Deptrac are clean, and the changed files lint on PHP 8.2.

Documentation

The migration guide from 4.2 to 4.3 is updated in Spomky-Labs/docs#37.