[BUG] jose can`t verify self-signed message

[m-onyshchuk]

Describe the bug I try to use jose to create JWT with private key from Ory JWKS. I got error message "failed to verify jws message: could not verify message using any of the signatures or keys" after JWT verifying. After simplifying the situation, I can specify the steps for playback.

To Reproduce

1. Run script to generate JWK file:

   #!/bin/bash
   JWK_FILE=jwk~.json
   jose jwk generate -t RSA > $JWK_FILE

   I got next file:

   {
   "d": "C22ITIdhTzA44fW0CYBcMHCFzInJ5-Y6MJMfloPFmhxDnO2O_s4HZNZAGH1IJh3hHc1qlZW14P6OcfIXWxq_5Prr65SeeAq59GHXk_QovCCvjIaNWFlFlXtqsPBuQtOlkJXrfkPC95hEqS2wBMGizPr46sDHXNvrZyDyBBhSbUs6EpYgIQZrAGSDzXmDUlyU-wQDSnshHWGr9dQjObNKo_o03aWbPt27d2OivRhXV6zSChCkHIiSJfszM0lgv_BBXiDos23oSb5uP5SIimRheuFIZmqHzv-GvuQZu1PFSKpNNFM0s5TBLhtazO17Lkr6Lxb9g7JnfubT3SEBEUMvYQ",
   "dp": "FgxOPI9e58cZrrY2hPjaJCBwjWMDrZWveU-TgSdiDUTkR7sXIc4qo9K5njMEfUas1T46mVYX6DvJyHFqRAVJg-NIJMVvyhQ_9qOgP66B9UotPjKQAygWdudpeyx1_VxxP5Zc5P754uUpVzZJgKjjRM4PMQLrun-Oo0SLJu7XKPs",
   "dq": "kPBjNtYi573k-gtIgrxRBuxCQmGIZtpxvtjosEgdvs4tDy9fTF4OPVBPeVbKecYq8JE8_dZYTApxQU5C897lbHHwJMAjegpYus7x0ywSaaQsFLTZupbPOj34A3cZd49sEQtbehmmz4--9cfPyNSPHwcJvMhNlYv1GnQFqFvIWtE",
   "e": "AQAB",
   "kty": "RSA",
   "n": "t-0fT_LJl3u6uwHix3GFVMqTrn8l07_BDmqijgrSGUPBNOIR4KFVLZ69B2Eb4DC81inE10ei35ZYjNveoRNM7xOr6ed8BJoG_DcR969R_5Yb_V2qbg71XBoqBLkIwUBm3gTIb5t88R1wP4TabsCZ0JU-OPCKqjPR66cM4_tha_4iu90U9m4pwkP7kJYmlyaviHtAx3iOZLIZ0KXKGvqCQ4FqBrdaz-2b6kE5D8iByb9sAOIjq85eipQXluOtsSZBnPHEnG3y-OJ7yuzJIxqEi5r6yzZST0P-XufhWHmhrKePZQ5O1lCB0o0jubo9nfuYlq1BqXct1JYbLH_tDb3rHQ",
   "p": "0g3tzAidKcrWWYjiYkxB1QBcNisiXxjckkr7E95UDhousL8XqigiT8PEC1ZAio52Q-tNgIc1yZSsYxwyqlow8aCoNmRtGHOXKXqn0AVrgXmZrGiUxiKFahg0MmL1wmN13C9a5EUtgkDWOMaasxd61ZZib3_cLYYziS4f6SZfMEc",
   "q": "4Cgja6-K1kv0KLHd9ti7JoCDvL-kax1jRqxjOiUa3VLDVLMZWNyKxgti5D-f1AY28VVJT1QU5IRn4dbyJHOQI1MnbcHl9rUnnN_v96y20NJ1yJ7M6aB2zLSrGBxmKPCzmCMQ5l4_XfF-BxjTltyfaVi8s1BWZlKDl0b_D1Q9_3s",
   "qi": "xr_CNh_MSgSN4s2P-Ca6sIhsqoD-Y23jIlXHG95pXeSZyyotkdRJsqUZ0Pd292OOIgpFmB64UC_LlFMUmxhbojEdgTux2-K8yiwMJmdLfimdstBXRd_ZuHgjZ97_3QdTdlUfZYKvA5D8k4tig5nWwdkHdmuqDMKjBwY0Ass-qEI"
   }

   I have prepared next payload~.json file:

   {"sub":"user1"}

2. Run script to sign & verify JWS:

   JWK_FILE=jwk~.json
   echo "create jwt ..."
   jwt=$(jose jws sign --key $JWK_FILE --algorithm RS256 payload~.json)
   echo "$jwt"
   echo "verify jwt ..."
   echo "$jwt" | jose jws verify --key $JWK_FILE --algorithm RS256 -

Expected behavior jose generated next JWS:

eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyMSJ9.kvv2p58U4QbEj6sh-D_AHRrppisSTone4vI5Im8kgY4AS1rZ9q9xc4PmzF4-NIfmAgs736_mvz49cyOi6DXJgnU1U-qfuA4gpAdu8ENmBZHZ40xIUv2m-Zej4igaSc5CWgGhfR7npw_NwJFDj_Z7yclO-5Fvmtyj1PlGZWPatZ7uOuRjkLgB2HqC8YpsS4uGFgGnH4_46dX6yrMRRLUoI0bIBJqIJQr-pMdigoCbWn7WU1o-VigcFjO-F6mWL4ty48uAlWZKx8HJcI33iCniL5hkBaUyYdvzLj9AfXxPExFC7rwwj9cJgekI6RDbaPwuPbp9NjtvDW9NtY0zvurY8g

During verifying this JWS I gоt the following error:

ERRO failed to verify jws message: could not verify message using any of the signatures or keys

Desktop:

• OS: Ubuntu
• Go Version: 1.21
• Application Version: v0.0.6 (under MIT LICENSE)

Additional context What I do wrong?

[nao1215]

@m-onyshchuk Thanks for the bug report! I will look into the cause of the bug.