Use try_sign to avoid panics

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
                 include:
                     -   build: pinned
                         os: ubuntu-24.04
-                        rust: 1.85.0
+                        rust: 1.86.0
                     -   build: stable
                         os: ubuntu-latest
                         rust: stable

src/crypto/mod.rs

@@ -47,7 +47,7 @@ pub trait JwtVerifier: Verifier<Vec<u8>> {
 /// If you just want to encode a JWT, use `encode` instead.
 pub fn sign(message: &[u8], key: &EncodingKey, algorithm: Algorithm) -> Result<String> {
     let provider = (CryptoProvider::get_default().signer_factory)(&algorithm, key)?;
-    Ok(b64_encode(provider.sign(message)))
+    Ok(b64_encode(provider.try_sign(message)?))
 }
 
 /// Compares the signature given with a re-computed signature for HMAC or using the public key

src/encoding.rs

@@ -168,7 +168,7 @@ pub fn encode<T: Serialize>(header: &Header, claims: &T, key: &EncodingKey) -> R
     let encoded_claims = b64_encode_part(claims)?;
     let message = [encoded_header, encoded_claims].join(".");
 
-    let signature = b64_encode(signing_provider.sign(message.as_bytes()));
+    let signature = b64_encode(signing_provider.try_sign(message.as_bytes())?);
 
     Ok([message, signature].join("."))
 }

src/errors.rs

@@ -48,6 +48,8 @@ pub enum ErrorKind {
     InvalidRsaKey(String),
     /// We could not sign with the given key
     RsaFailedSigning,
+    /// Signing failed
+    Signing(String),
     /// When the algorithm from string doesn't match the one passed to `from_str`
     InvalidAlgorithmName,
     /// When a key is provided with an invalid format
@@ -91,6 +93,7 @@ impl StdError for Error {
             ErrorKind::InvalidEcdsaKey => None,
             ErrorKind::InvalidEddsaKey => None,
             ErrorKind::RsaFailedSigning => None,
+            ErrorKind::Signing(_) => None,
             ErrorKind::InvalidRsaKey(_) => None,
             ErrorKind::ExpiredSignature => None,
             ErrorKind::MissingAlgorithm => None,
@@ -129,6 +132,7 @@ impl fmt::Display for Error {
             | ErrorKind::InvalidAlgorithmName => write!(f, "{:?}", self.0),
             ErrorKind::MissingRequiredClaim(c) => write!(f, "Missing required claim: {}", c),
             ErrorKind::InvalidRsaKey(msg) => write!(f, "RSA key invalid: {}", msg),
+            ErrorKind::Signing(msg) => write!(f, "Signing failed: {}", msg),
             ErrorKind::Json(err) => write!(f, "JSON error: {}", err),
             ErrorKind::Utf8(err) => write!(f, "UTF-8 error: {}", err),
             ErrorKind::Base64(err) => write!(f, "Base64 error: {}", err),
@@ -170,6 +174,12 @@ impl From<ErrorKind> for Error {
     }
 }
 
+impl From<signature::Error> for Error {
+    fn from(err: signature::Error) -> Error {
+        new_error(ErrorKind::Signing(err.to_string()))
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use wasm_bindgen_test::wasm_bindgen_test;