Skip to content

AGENTS.md: keep JWT and JWK code on the standard library - #2301

Merged
Taahir Ahmed (ahmedtd) merged 1 commit into
agent-substrate:mainfrom
thompsonmax:agents-md-jose-in-tree
Oct 7, 2026
Merged

Taahir Ahmed (ahmedtd) merged 1 commit into
agent-substrate:mainfrom
thompsonmax:agents-md-jose-in-tree

Conversation

@thompsonmax

Copy link
Copy Markdown
Collaborator

Part of #1756.

  • AGENTS.md's Security Considerations now says JWT signing, verification, and JWK set publishing are built on the standard library's crypto packages, and that new code should extend those packages instead of adding go-jose or another JOSE library. Reviewers agreed on this on Build the JWK set that publishes actor JWT verification keys #2132, but it wasn't written down anywhere.

internal/oidcdiscovery still imports go-jose on main for key IDs; #2132 removes that import.

Testing: docs only, so nothing to run.

  • Tests pass
  • Appropriate changes to documentation are included in the PR

Actor JWT signing, verification and JWK set publishing are written
against the standard library's crypto packages, and reviewers have asked
to keep it that way. Say so where contributors and agents look, so new
code extends those packages instead of pulling in go-jose.
@ahmedtd
Taahir Ahmed (ahmedtd) added this pull request to the merge queue Oct 7, 2026
Merged via the queue into agent-substrate:main with commit fc1e808 Oct 7, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants