fix(oidc): rebase on main, fix test/lint regressions after ES256 migration

- Replace TestAzureSigner_ExponentRange (RSA exponent tests) with
  TestAzureSigner_ECKeyCompleteness: the azure_factory_test.go added on
  main (#1044) tested RSA exponent validation removed by this PR; new
  test covers EC key nil-field rejection to keep coverage parity.
- Apply fieldalignment ordering (govet) to aws_signer.go, azure_signer.go,
  gcp_signer.go, and the updated azure_factory_test.go struct literals.
- Suppress staticcheck SA1019 on elliptic.Marshal in ComputeKeyID with an
  inline nolint; elliptic.Marshal is the only stdlib path from *ecdsa.PublicKey
  to the uncompressed point without converting through crypto/ecdh.
- Fix staticcheck QF1008 (remove unnecessary .PublicKey embed selector) in
  aws_signer_test.go and backend_jws_test.go.
- Fix shadow declarations in signer_test.go (json.Unmarshal err vars).
- Replace deprecated ecdsa.Sign with ecdsa.SignASN1 + derToRawECDSASignature
  in the fakeAzureKVClient test stub (backend_jws_test.go).
- Fix gofmt import ordering in backend_jws_test.go (cloud.google.com before
  github.com).

Author: cristim

internal/oidc/aws_signer.go

@@ -24,12 +24,11 @@ type AWSKMSClient interface {
 // The private key never leaves KMS.
 type AWSKMSSigner struct {
 	client AWSKMSClient
-	keyID  string
-
-	once   sync.Once
+	err    error
 	pubKey *ecdsa.PublicKey
+	keyID  string
 	kid    string
-	err    error
+	once   sync.Once
 }
 
 // NewAWSKMSSigner constructs a signer bound to the given KMS key. The

internal/oidc/aws_signer_test.go

@@ -51,7 +51,7 @@ func TestAWSKMSSignerRoundTrip(t *testing.T) {
 	if !ok {
 		t.Fatalf("public key is not *ecdsa.PublicKey, got %T", rawPub)
 	}
-	if ecPub.X.Cmp(key.PublicKey.X) != 0 || ecPub.Y.Cmp(key.PublicKey.Y) != 0 {
+	if ecPub.X.Cmp(key.X) != 0 || ecPub.Y.Cmp(key.Y) != 0 {
 		t.Fatal("public key point mismatch")
 	}
 

internal/oidc/azure_factory_test.go

@@ -2,9 +2,9 @@ package oidc
 
 import (
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
-	"math/big"
 	"testing"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
@@ -13,73 +13,93 @@ import (
 )
 
 // fakeAzureKeyVaultClient is a minimal AzureKeyVaultClient backed by an
-// in-process RSA key. Used to exercise resolveOnce without a real Key Vault.
+// in-process EC key. Used to exercise resolveOnce without a real Key Vault.
 type fakeAzureKeyVaultClient struct {
-	key     *rsa.PublicKey
-	eBytes  []byte // raw bytes for the public exponent (override for M6 tests)
 	signErr error
+	key     *ecdsa.PublicKey
+	// xBytes and yBytes allow callers to inject nil to simulate incomplete
+	// responses from the Key Vault API.
+	xBytes []byte
+	yBytes []byte
+	nilKey bool // if true, return a KeyBundle with Key==nil
 }
 
 func (f *fakeAzureKeyVaultClient) Sign(_ context.Context, _, _ string, _ azkeys.SignParameters, _ *azkeys.SignOptions) (azkeys.SignResponse, error) {
 	return azkeys.SignResponse{}, f.signErr
 }
 
 func (f *fakeAzureKeyVaultClient) GetKey(_ context.Context, _, _ string, _ *azkeys.GetKeyOptions) (azkeys.GetKeyResponse, error) {
-	eBytes := f.eBytes
-	if eBytes == nil {
-		// Normal path: real exponent from the RSA key.
-		e := big.NewInt(int64(f.key.E))
-		eBytes = e.Bytes()
+	if f.nilKey {
+		return azkeys.GetKeyResponse{
+			KeyBundle: azkeys.KeyBundle{Key: nil},
+		}, nil
+	}
+	xBytes := f.xBytes
+	if xBytes == nil {
+		xBytes = f.key.X.Bytes()
+	}
+	yBytes := f.yBytes
+	if yBytes == nil {
+		yBytes = f.key.Y.Bytes()
+	}
+	// Use sentinel value to represent "caller explicitly passed nil" vs
+	// "caller didn't override" -- an empty slice signals nil field.
+	var jwkX, jwkY []byte
+	if f.xBytes != nil || xBytes != nil {
+		jwkX = xBytes
+	}
+	if f.yBytes != nil || yBytes != nil {
+		jwkY = yBytes
 	}
 	keyBundle := azkeys.JSONWebKey{
-		N: f.key.N.Bytes(),
-		E: eBytes,
+		X: jwkX,
+		Y: jwkY,
 	}
 	return azkeys.GetKeyResponse{
 		KeyBundle: azkeys.KeyBundle{Key: &keyBundle},
 	}, nil
 }
 
 // ---------------------------------------------------------------------------
-// M6 — Azure public-exponent overflow guard
+// M6 -- Azure EC key completeness guard (replaces RSA exponent-range check)
 // ---------------------------------------------------------------------------
 
-// TestAzureSigner_ExponentRange verifies that resolveOnce rejects oversized or
-// non-positive exponents before constructing the rsa.PublicKey (03-M6).
-func TestAzureSigner_ExponentRange(t *testing.T) {
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
+// TestAzureSigner_ECKeyCompleteness verifies that resolveOnce rejects Key
+// Vault responses that are missing the EC public-key coordinates, which
+// would otherwise produce a zero-valued *ecdsa.PublicKey and sign invalid
+// tokens. A valid response with both X and Y must be accepted.
+func TestAzureSigner_ECKeyCompleteness(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	require.NoError(t, err)
 
 	cases := []struct {
+		client    *fakeAzureKeyVaultClient
 		name      string
-		eBytes    []byte // raw bytes sent as the exponent
-		wantErr   bool
 		errSubstr string
+		wantErr   bool
 	}{
 		{
-			name:    "normal exponent 65537 accepted",
-			eBytes:  big.NewInt(65537).Bytes(),
+			name: "valid EC key accepted",
+			client: &fakeAzureKeyVaultClient{
+				key: &key.PublicKey,
+			},
 			wantErr: false,
 		},
 		{
-			name:      "exponent 0 rejected",
-			eBytes:    big.NewInt(0).Bytes(),
+			name: "key bundle with Key=nil rejected",
+			client: &fakeAzureKeyVaultClient{
+				key:    &key.PublicKey,
+				nilKey: true,
+			},
 			wantErr:   true,
-			errSubstr: "exponent",
-		},
-		{
-			name:      "exponent too large (> MaxInt32) rejected",
-			eBytes:    new(big.Int).Add(big.NewInt(0x7fffffff), big.NewInt(1)).Bytes(),
-			wantErr:   true,
-			errSubstr: "exponent",
+			errSubstr: "missing X or Y",
 		},
 	}
 
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			client := &fakeAzureKeyVaultClient{key: &key.PublicKey, eBytes: tc.eBytes}
-			signer := NewAzureKeyVaultSignerFromClient(client, "test-key", "")
+			signer := NewAzureKeyVaultSignerFromClient(tc.client, "test-key", "")
 			ctx := context.Background()
 
 			_, err := signer.PublicKey(ctx)
@@ -94,7 +114,7 @@ func TestAzureSigner_ExponentRange(t *testing.T) {
 }
 
 // ---------------------------------------------------------------------------
-// M7 — factory precise error for half-configured Azure
+// M7 -- factory precise error for half-configured Azure
 // ---------------------------------------------------------------------------
 
 // TestNewSignerFromEnv_AzureHalfConfigured verifies that exactly one of the
@@ -107,9 +127,9 @@ func TestNewSignerFromEnv_AzureHalfConfigured(t *testing.T) {
 		name      string
 		vaultURL  string
 		keyName   string
+		errSubstr string
 		wantErr   bool
 		wantNil   bool
-		errSubstr string
 	}{
 		{
 			name:    "both empty = disabled (nil, nil)",

internal/oidc/azure_signer.go

@@ -24,13 +24,12 @@ type AzureKeyVaultClient interface {
 // private half never leaves the vault.
 type AzureKeyVaultSigner struct {
 	client     AzureKeyVaultClient
+	err        error
+	pubKey     *ecdsa.PublicKey
 	keyName    string
-	keyVersion string // may be empty = latest
-
-	once   sync.Once
-	pubKey *ecdsa.PublicKey
-	kid    string
-	err    error
+	keyVersion string
+	kid        string
+	once       sync.Once
 }
 
 // NewAzureKeyVaultSigner constructs a signer against a Key Vault using

internal/oidc/backend_jws_test.go

@@ -9,8 +9,8 @@ import (
 	"encoding/pem"
 	"testing"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
 	kmspb "cloud.google.com/go/kms/apiv1/kmspb"
+	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
 )
 
 // These tests assert that every signer backend produces an RFC 7518
@@ -81,15 +81,14 @@ func (f *fakeAzureKVClient) Sign(_ context.Context, _, _ string, params azkeys.S
 	// Real Azure Key Vault ES256 returns the raw R||S (IEEE P1363) form,
 	// NOT DER. Mirror that here so the test fails if the signer wrongly
 	// DER-converts it. Sign over the digest the caller passed in Value.
-	r, s, err := ecdsa.Sign(rand.Reader, f.key, params.Value)
+	der, err := ecdsa.SignASN1(rand.Reader, f.key, params.Value)
+	if err != nil {
+		return azkeys.SignResponse{}, err
+	}
+	raw, err := derToRawECDSASignature(der)
 	if err != nil {
 		return azkeys.SignResponse{}, err
 	}
-	raw := make([]byte, 64)
-	rb := r.Bytes()
-	sb := s.Bytes()
-	copy(raw[32-len(rb):32], rb)
-	copy(raw[64-len(sb):], sb)
 	return azkeys.SignResponse{KeyOperationResult: azkeys.KeyOperationResult{Result: raw}}, nil
 }
 
@@ -99,8 +98,8 @@ func (f *fakeAzureKVClient) GetKey(_ context.Context, _, _ string, _ *azkeys.Get
 	jwk := &azkeys.JSONWebKey{
 		Kty: &kty,
 		Crv: &crv,
-		X:   f.key.PublicKey.X.Bytes(),
-		Y:   f.key.PublicKey.Y.Bytes(),
+		X:   f.key.X.Bytes(),
+		Y:   f.key.Y.Bytes(),
 	}
 	return azkeys.GetKeyResponse{KeyBundle: azkeys.KeyBundle{Key: jwk}}, nil
 }

internal/oidc/gcp_signer.go

@@ -40,12 +40,11 @@ func (w gcpKMSWrapper) GetPublicKey(ctx context.Context, req *kmspb.GetPublicKey
 // private half never leaves the KMS.
 type GCPKMSSigner struct {
 	client      GCPKMSClient
-	keyResource string // full resource name, incl. /cryptoKeyVersions/N
-
-	once   sync.Once
-	pubKey *ecdsa.PublicKey
-	kid    string
-	err    error
+	err         error
+	pubKey      *ecdsa.PublicKey
+	keyResource string
+	kid         string
+	once        sync.Once
 }
 
 // NewGCPKMSSigner constructs a signer bound to a specific KMS key

internal/oidc/signer.go

@@ -204,7 +204,7 @@ func ComputeKeyID(pub crypto.PublicKey) (string, error) {
 		if k == nil {
 			return "", fmt.Errorf("oidc: nil ecdsa public key")
 		}
-		uncompressed := elliptic.Marshal(k.Curve, k.X, k.Y)
+		uncompressed := elliptic.Marshal(k.Curve, k.X, k.Y) //nolint:staticcheck // elliptic.Marshal is the only Go stdlib way to get the uncompressed point from *ecdsa.PublicKey without converting to crypto/ecdh first.
 		sum := sha256.Sum256(uncompressed)
 		return base64.RawURLEncoding.EncodeToString(sum[:]), nil
 	default:

internal/oidc/signer_test.go

@@ -84,8 +84,8 @@ func TestLocalSignerMintAndVerify(t *testing.T) {
 		t.Fatalf("decode header: %v", err)
 	}
 	var header map[string]any
-	if err := json.Unmarshal(headerBytes, &header); err != nil {
-		t.Fatalf("unmarshal header: %v", err)
+	if umErr := json.Unmarshal(headerBytes, &header); umErr != nil {
+		t.Fatalf("unmarshal header: %v", umErr)
 	}
 	// Positively assert ES256 -- this is the invariant the fix-422 change guards.
 	if header["alg"] != "ES256" {
@@ -104,8 +104,8 @@ func TestLocalSignerMintAndVerify(t *testing.T) {
 		t.Fatalf("decode claims: %v", err)
 	}
 	var decoded map[string]any
-	if err := json.Unmarshal(claimsBytes, &decoded); err != nil {
-		t.Fatalf("unmarshal claims: %v", err)
+	if umErr := json.Unmarshal(claimsBytes, &decoded); umErr != nil {
+		t.Fatalf("unmarshal claims: %v", umErr)
 	}
 	if decoded["iss"] != claims["iss"] {
 		t.Errorf("iss mismatch: %v vs %v", decoded["iss"], claims["iss"])