[NopeCharon]

What

Adds marshal() to both bundle types, the reverse of their existing parse methods:

• X509Bundle.marshal() returns the X.509 authorities as PEM CERTIFICATE blocks, wrapped at 64 characters.
• JwtBundle.marshal() returns the JWT authorities as an RFC 7517 JWKS document in UTF-8 JSON. Each authority becomes one public JWK with its key ID. Keys are ordered by key ID, so the same bundle always gives the same output.

Files.write(Paths.get("/tmp/bundle.pem"), x509Source.getBundleForTrustDomain(td).marshal());
Files.write(Paths.get("/tmp/bundle.jwks"), jwtSource.getBundleForTrustDomain(td).marshal());

Details:

• JwtBundle.marshal() supports EC keys on a named JWK curve, and RSA keys. These are the key types parse accepts. Any other key type or curve throws JwtBundleException, and the message names the key ID.
• X509Bundle.marshal() throws X509BundleException if an authority can't be DER-encoded.
• parse reads back the output of both methods. One exception: a bundle with no X.509 authorities marshals to an empty array, and X509Bundle.parse still rejects that. The Javadoc says so.
• JwtBundle.parse now decodes its input as UTF-8, not with the platform default charset. JSON is UTF-8. Before this, on Java 8–17 with a non-UTF-8 default charset, non-ASCII key IDs were corrupted and a marshaled bundle didn't round-trip.
• The core README has a short "Marshal bundles" section, and the changelog lists the methods under Unreleased.

Fixes #508

Why

A bundle from an X509Source or JwtSource couldn't be serialized again. To store it, pass it to another process, or serve it as a JWKS, callers had to write the encoding themselves. For JWT bundles that included the Nimbus curve lookup for EC keys. go-spiffe offers the same operation as Bundle.Marshal() in x509bundle and jwtbundle.

Compatibility: this only adds methods to two final classes. japicmp and the binary-compatibility suite pass.

How tested

• X509BundleTest:
  • a bundle loaded from certs.pem round-trips through marshal/parse
  • the output has one well-formed PEM block per authority, with no line over 64 characters
  • an empty bundle marshals to an empty array
  • an encoding failure is wrapped in X509BundleException
• JwtBundleTest:
  • P-256, P-384, P-521 and RSA keys round-trip
  • a bundle parsed from the existing jwks_valid_RSA_EC.json fixture round-trips
  • the JWKS holds public keys only, ordered by key ID, with the right kty/crv
  • a non-ASCII key ID round-trips
  • an empty bundle gives {"keys":[]}
  • an unsupported key type, and an EC key on an unnamed curve, both throw JwtBundleException
• Commands, on JDK 17: ./gradlew :java-spiffe-core:build :java-spiffe-provider:build binaryCompatibilityTest javadoc.

The non-ASCII key ID test checks the round trip. It can't fail on JDK 18+, where UTF-8 is already the default charset.

[maxlambrecht]

LGTM!