fix: always use raw signature format on crypto.Signer impl

Signed-off-by: Pierre-Henri Symoneaux <[email protected]>

Author: phsym

examples/sign_verify.go

@@ -43,7 +43,7 @@ func signVerify(ctx context.Context, kmsClient *okms.Client) {
 	fmt.Println("Is valid:", result)
 
 	// You can also instantiate an stdlib crypto.Signer
-	signer, err := kmsClient.NewSigner(ctx, respECDSA.Id, &format)
+	signer, err := kmsClient.NewSigner(ctx, respECDSA.Id)
 	if err != nil {
 		panic(err)
 	}

examples/utils.go

@@ -37,8 +37,7 @@ func TestSigner_RSA(t *testing.T) {
 		}, nil).
 		Once()
 
-	signFormat := types.Raw
-	signer, err := client.NewSigner(context.Background(), keyId, &signFormat)
+	signer, err := client.NewSigner(context.Background(), keyId)
 	require.NoError(t, err)
 	require.Equal(t, pKey.Public(), signer.Public())
 
@@ -99,7 +98,7 @@ func TestSigner_ECDSA(t *testing.T) {
 		}, nil).
 		Once()
 
-	signer, err := client.NewSigner(context.Background(), keyId, nil)
+	signer, err := client.NewSigner(context.Background(), keyId)
 	require.NoError(t, err)
 	require.Equal(t, pKey.Public(), signer.Public())
 

sign_test.go

@@ -27,19 +27,19 @@ import (
 // NewSigner creates a new [crypto.Signer] for the given key-pair.
 //
 // NewSigner cannot be used with symetric keys.
-func (client *Client) NewSigner(ctx context.Context, serviceKeyID uuid.UUID, format *types.SignatureFormats) (crypto.Signer, error) {
+func (client *Client) NewSigner(ctx context.Context, serviceKeyID uuid.UUID) (crypto.Signer, error) {
 	k, err := client.ExportJwkPublicKey(ctx, serviceKeyID)
 	if err != nil {
 		return nil, err
 	}
-	return newSigner(client, k, format)
+	return newSigner(client, k)
 }
 
 // newSigner creates a new [crypto.Signer] using the given public JsonWebKey and
 // its remote private key.
 //
 // newSigner cannot be used with symetric keys.
-func newSigner(api SignatureApi, jwk *types.JsonWebKeyResponse, format *types.SignatureFormats) (crypto.Signer, error) {
+func newSigner(api SignatureApi, jwk *types.JsonWebKeyResponse) (crypto.Signer, error) {
 	pubKey, err := jwk.PublicKey()
 	if err != nil {
 		return nil, err
@@ -49,15 +49,13 @@ func newSigner(api SignatureApi, jwk *types.JsonWebKeyResponse, format *types.Si
 		JsonWebKeyResponse: jwk,
 		api:                api,
 		pubKey:             pubKey,
-		format:             format,
 	}, nil
 }
 
 type jwkSigner struct {
 	*types.JsonWebKeyResponse
 	api    SignatureApi
 	pubKey crypto.PublicKey
-	format *types.SignatureFormats
 }
 
 // Public returns the public key corresponding to the opaque,
@@ -130,12 +128,8 @@ func (sign *jwkSigner) doSign(digest []byte, hash crypto.Hash, algPrefix string)
 	if err != nil {
 		return nil, fmt.Errorf("Key ID %q is not a valid UUID", sign.Kid)
 	}
-	format := sign.format
-	if format == nil {
-		rawFormat := types.Raw
-		format = &rawFormat
-	}
-	resp, err := sign.api.Sign(context.Background(), keyId, format, alg, true, digest)
+	rawFormat := types.Raw
+	resp, err := sign.api.Sign(context.Background(), keyId, &rawFormat, alg, true, digest)
 	if err != nil {
 		return nil, err
 	}