Open dev-aaront-org opened 4 days ago
I was thinking about this some more and I realized that my fix enabled some nonsense scenarios where the key file could come from Signer
but the key type from Signature
, so I've tweaked it a bit. Now, if the key file comes from $signature
, then the key type comes from $signature->algorithm
. And likewise, if the key file comes from $self
, the key type comes from $self->{Algorithm}
.
If a
Signature
object'sKey
orKeyFile
property is set to a non-ref,Signer
assumes it is a file path and attempts to load the private key from it, but it may use the wrong key type, which will cause the signature to fail. CurrentlySigner
looks at$self->{Algorithm}
to determine the key type, and this changes it to look at theSignature
's algorithm instead.I'm not entirely sure this fix is right or necessary because it doesn't really look like a supported use case. The docs for
Signature
say thatKey
should be an object, andKeyFile
is not used at all withinSignature
. So I was also considering just removing the key loading fromSigner
and making it the user's responsibility to load their own keys if they're creating their ownSignature
s. But that would be a backward-incompatible change.Anyway, I'm certainly open to suggestions if you prefer a different fix.