removed "ubuntu:24.04", added "ubuntu:25.10"

# Conflicts:
#   requirements.txt

.DEBIAN/control

@@ -2,7 +2,7 @@ Package: fastapi-dls
 Version: 0.0
 Architecture: all
 Maintainer: Oscar Krause oscar.krause@collinwebdesigns.de
-Depends: python3, python3-fastapi, python3-uvicorn, python3-dotenv, python3-dateutil, python3-jose, python3-sqlalchemy, python3-cryptography, python3-markdown, uvicorn, openssl
+Depends: python3, python3-fastapi, python3-uvicorn, python3-dotenv, python3-dateutil, python3-jwt, python3-sqlalchemy, python3-cryptography, python3-markdown, uvicorn, openssl
 Recommends: curl
 Installed-Size: 10240
 Homepage: https://git.collinwebdesigns.de/oscar.krause/fastapi-dls

.DEBIAN/env.default

@@ -1,6 +1,9 @@
 # Toggle debug mode
 #DEBUG=false
 
+# Cert Path
+CERT_PATH="/etc/fastapi-dls/cert"
+
 # Where the client can find the DLS server
 DLS_URL=127.0.0.1
 DLS_PORT=443

.DEBIAN/postinst

@@ -3,6 +3,8 @@
 WORKING_DIR=/usr/share/fastapi-dls
 CONFIG_DIR=/etc/fastapi-dls
 
+source $CONFIG_DIR/env
+
 while true; do
   [ -f $CONFIG_DIR/webserver.key ] && default_answer="N" || default_answer="Y"
   [ $default_answer == "Y" ] && V="Y/n" || V="y/N"
@@ -25,27 +27,32 @@ if [ -f $CONFIG_DIR/webserver.key ]; then
 
   if [ -x "$(command -v curl)" ]; then
     echo "> Testing API ..."
-    source $CONFIG_DIR/env
     curl --insecure -X GET https://$DLS_URL:$DLS_PORT/-/health
   else
     echo "> Testing API failed, curl not available. Please test manually!"
   fi
 fi
 
+echo "> Create Certificate-Chain folder ..."
+mkdir -p $CERT_PATH
+
+echo "> Set permissions ..."
 chown -R www-data:www-data $CONFIG_DIR
 chown -R www-data:www-data $WORKING_DIR
 
+echo "> Done."
+
 cat <<EOF
 
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 #                                                                             #
 #    fastapi-dls is now installed.                                            #
 #                                                                             #
-#    Service should be up and running.                                        #
+#    Service should be up and running (if you choose to auto-generate         #
-#      Webservice is listen to https://localhost                              #
+#     self-signed webserver certificate).                                     #
-#                                                                             #
-#    Configuration is stored in /etc/fastapi-dls/env.                         #
 #                                                                             #
+#    - Webservice is listen to https://localhost                              #                                                                       #
+#    - Configuration is stored in /etc/fastapi-dls/env                        #
 #                                                                             #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 

.DEBIAN/requirements-bookworm-12.txt

@@ -1,7 +1,7 @@
 # https://packages.debian.org/hu/
 fastapi==0.92.0
 uvicorn[standard]==0.17.6
-python-jose[cryptography]==3.3.0
+pyjwt==2.10.1
 cryptography==38.0.4
 python-dateutil==2.8.2
 sqlalchemy==1.4.46

.DEBIAN/requirements-trixie-13.txt

@@ -0,0 +1,11 @@
+# https://packages.debian.org/hu/
+fastapi==0.115.11
+uvicorn[standard]==0.32.0
+pyjwt==2.10.1
+cryptography==43.0.0
+python-dateutil==2.9.0
+sqlalchemy==2.0.40
+markdown==3.7
+python-dotenv==1.0.1
+jinja2==3.1.6
+httpx==0.28.1

.DEBIAN/requirements-ubuntu-24.04.txt

@@ -1,7 +1,7 @@
 # https://packages.ubuntu.com
 fastapi==0.101.0
 uvicorn[standard]==0.27.1
-python-jose[cryptography]==3.3.0
+pyjwt==2.10.1
 cryptography==41.0.7
 python-dateutil==2.8.2
 sqlalchemy==1.4.50

.DEBIAN/requirements-ubuntu-24.10.txt

@@ -1,7 +1,7 @@
 # https://packages.ubuntu.com
 fastapi==0.110.3
 uvicorn[standard]==0.30.3
-python-jose[cryptography]==3.3.0
+pyjwt==2.10.1
 cryptography==42.0.5
 python-dateutil==2.9.0
 sqlalchemy==2.0.32

.PKGBUILD/PKGBUILD

@@ -8,7 +8,7 @@ pkgdesc='NVIDIA DLS server implementation with FastAPI'
 arch=('any')
 url='https://git.collinwebdesigns.de/oscar.krause/fastapi-dls'
 license=('MIT')
-depends=('python' 'python-jose' 'python-starlette' 'python-httpx' 'python-fastapi' 'python-dotenv' 'python-dateutil' 'python-sqlalchemy' 'python-cryptography' 'uvicorn' 'python-markdown' 'openssl')
+depends=('python' 'python-pyjwt' 'python-starlette' 'python-httpx' 'python-fastapi' 'python-dotenv' 'python-dateutil' 'python-sqlalchemy' 'python-cryptography' 'uvicorn' 'python-markdown' 'openssl')
 provider=("$pkgname")
 install="$pkgname.install"
 backup=('etc/default/fastapi-dls')

.gitlab-ci.yml

@@ -172,12 +172,12 @@ test:apt:
   parallel:
     matrix:
       - IMAGE:
-          # - debian:trixie-slim # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy"
+          - debian:trixie-slim # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" or "python3-jwt"
           - debian:bookworm-slim # EOL: June 06, 2026
-          - debian:bookworm-slim # EOL: June 06, 2026
+          - debian:bullseye-slim # EOL: June 06, 2026
-          - ubuntu:24.04 # EOL: April 2036
+          - ubuntu:24.04 # EOL: April 2036 (Noble Numbat)
-          # - ubuntu:24.10 # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy"
+          - ubuntu:25.04 # EOL: January 2026 (Plucky Puffin); "python3-jose" not available, but "python3-josepy" or "python3-jwt"
-          # - ubuntu:25.04 # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy"
+          - ubuntu:25.10 # EOL: July 2026 (Questing Quokka);
   needs:
     - job: build:apt
       artifacts: true
@@ -250,7 +250,7 @@ semgrep-sast:
 
 test_coverage:
 #  extends: test
-  image: python:3.12-slim-bookworm
+  image: python:3.13-slim-trixie
   allow_failure: true
   stage: test
   rules:

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-alpine
+FROM python:3.13-alpine
 
 ARG VERSION
 ARG COMMIT=""

README.md

@@ -4,13 +4,13 @@ Minimal Delegated License Service (DLS).
 
 > [!warning] Branch support
 > FastAPI-DLS Version 1.x supports up to **`17.x`** releases. \
-> FastAPI-DLS Version 2.x is backwards compatible to `17.x` and supports **`18.x`** releases in combination
+> FastAPI-DLS Version 2.x is backwards compatible to `17.x` and supports **`18.x`**, **`19.x`**, releases in combination
-> with [gridd-unlock-patcher](https://git.collinwebdesigns.de/oscar.krause/gridd-unlock-patcher).
+> with [gridd-unlock-patcher](https://git.collinwebdesigns.de/vgpu/gridd-unlock-patcher).
 > Other combinations of FastAPI-DLS and Driver-Branches may work but are not tested.
 
 > [!note] Compatibility
-> Compatibility tested with official NLS 2.0.1, 2.1.0, 3.1.0, 3.3.1, 3.4.0. For Driver compatibility
+> Compatibility tested with official NLS 2.0.1, 2.1.0, 3.1.0, 3.3.1, 3.4.0. **For Driver compatibility
-> see [compatibility matrix](#vgpu-software-compatibility-matrix).
+> see [compatibility matrix](#vgpu-software-compatibility-matrix)**.
 
 This service can be used without internet connection.
 Only the clients need a connection to this service on configured port.
@@ -18,7 +18,6 @@ Only the clients need a connection to this service on configured port.
 **Official Links**
 
 * https://git.collinwebdesigns.de/oscar.krause/fastapi-dls (Private Git)
-* https://gitea.publichub.eu/oscar.krause/fastapi-dls (Public Git)
 * https://hub.docker.com/r/collinwebdesigns/fastapi-dls (Docker-Hub `collinwebdesigns/fastapi-dls:latest`)
 
 *All other repositories are forks! (which  is no bad - just for information and bug reports)*
@@ -329,6 +328,7 @@ Packages are available here:
 
 Successful tested with (**LTS Version**):
 
+- **Debian 13 (Trixie)** (EOL: June 30, 2028)
 - **Debian 12 (Bookworm)** (EOL: June 06, 2026)
 - *Ubuntu 22.10 (Kinetic Kudu)* (EOL: July 20, 2023)
 - *Ubuntu 23.04 (Lunar Lobster)* (EOL: January 2024)
@@ -337,10 +337,7 @@ Successful tested with (**LTS Version**):
 
 Not working with:
 
-- Debian 11 (Bullseye) and lower (missing `python-jose` dependency)
-- Debian 13 (Trixie) (missing `python-jose` dependency)
 - Ubuntu 22.04 (Jammy Jellyfish) (not supported as for 15.01.2023 due to [fastapi - uvicorn version missmatch](https://bugs.launchpad.net/ubuntu/+source/fastapi/+bug/1970557))
-- Ubuntu 24.10 (Oracular Oriole) (missing `python-jose` dependency)
 
 **Run this on your server instance**
 
@@ -416,7 +413,141 @@ acme.sh --issue -d example.com \
 
 After first success you have to replace `--issue` with `--renew`.
 
-# Configuration
+## Nginx Reverse Proxy (experimental)
+
+- This guide is written for Debian/Ubuntu systems, other may work, but you have to do your setup on your own
+- Uvicorn does no longer serve requests directly
+- NGINX is used as HTTP & HTTPS entrypoint
+- Assumes you already have set up webserver certificate and private-key
+
+**Install Nginx Webserver**
+
+```shell
+apt-get install nginx-light
+```
+
+**Remove default vhost**
+
+```shell
+rm /etc/nginx/sites-enabled/default
+```
+
+**Create fastapi-dls vhost**
+
+<details>
+    <summary>`/etc/nginx/sites-available/fastapi-dls`</summary>
+
+```
+upstream dls-backend {
+        server 127.0.0.1:8000;  # must match dls listen port
+}
+
+server {
+        listen 443 ssl http2 default_server;
+        listen [::]:443 ssl http2 default_server;
+
+        root /var/www/html;
+        index index.html;
+        server_name _;
+
+        ssl_certificate "/etc/fastapi-dls/cert/webserver.crt";
+        ssl_certificate_key "/etc/fastapi-dls/cert/webserver.key";
+        ssl_session_cache shared:SSL:1m;
+        ssl_session_timeout 10m;
+        ssl_protocols TLSv1.3 TLSv1.2;
+        # ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305";
+        # ssl_ciphers PROFILE=SYSTEM;
+        ssl_prefer_server_ciphers on;
+
+        location / {
+                # https://www.uvicorn.org/deployment/
+                proxy_set_header Host $http_host;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection $connection_upgrade;
+                proxy_redirect off;
+                proxy_buffering off;
+
+                proxy_set_header X-Real-IP $remote_addr;
+
+                proxy_pass http://dls-backend$request_uri;
+        }
+
+        location = /-/health {
+                access_log off;
+                add_header 'Content-Type' 'application/json';
+                return 200 '{\"status\":\"up\",\"service\":\"nginx\"}';
+        }
+}
+
+map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+}
+
+server {
+        listen 80;
+        listen [::]:80;
+
+        root /var/www/html;
+        index index.html;
+        server_name _;
+
+        location /leasing/v1/lessor/shutdown {
+                proxy_set_header Host $http_host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_pass http://dls-backend/leasing/v1/lessor/shutdown;
+        }
+
+        location / {
+                return 301 https://$host$request_uri;
+        }
+}
+```
+</details>
+
+**Enable and test vhost**
+
+```shell
+ln -s /etc/nginx/sites-available/fastapi-dls /etc/nginx/sites-enabled/fastapi-dls
+
+nginx -t
+# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
+# nginx: configuration file /etc/nginx/nginx.conf test is successful
+```
+
+**Override default fastapi-dls systemd service**
+
+```shell
+mkdir /etc/systemd/system/fastapi-dls.service.d
+```
+
+<details>
+    <summary>`/etc/systemd/system/fastapi-dls.service.d/override.conf`</summary>
+
+```
+[Service]
+ExecStart=
+ExecStart=uvicorn main:app \
+  --env-file /etc/fastapi-dls/env \
+  --host 127.0.0.1 --port 8000 \
+  --app-dir /usr/share/fastapi-dls/app \
+  --proxy-headers
+```
+</details>
+
+**Run**
+
+```shell
+systemctl daemon-reload
+service nginx start
+service fastapi-dls start
+```
+
+# Configuration (Service)
 
 | Variable               | Default                                | Usage                                                                                                |
 |------------------------|----------------------------------------|------------------------------------------------------------------------------------------------------|
@@ -539,7 +670,8 @@ Shows current runtime environment variables and their values.
 
 **`GET /-/config/root-certificate`**
 
-Returns the Root-Certificate Certificate which is used. This is required for patching `nvidia-gridd` on 18.x releases.
+Returns the Root-Certificate Certificate which is used.
+This is required for patching `nvidia-gridd` on `18.x`, `19.x` releases.
 
 **`GET /-/readme`**
 
@@ -750,14 +882,16 @@ The error message can safely be ignored (since we have no license limitation :P)
 # vGPU Software Compatibility Matrix
 
 <details>
-  <summary>Show Table</summary>
+  <summary>Successfully tested with this package versions: Show Table</summary>
-
-Successfully tested with this package versions.
 
 | FastAPI-DLS Version | vGPU Suftware | Driver Branch | Linux vGPU Manager | Linux Driver | Windows Driver |  Release Date |      EOL Date |
 |---------------------|:-------------:|:-------------:|--------------------|--------------|----------------|--------------:|--------------:|
-| `2.x`               |    `18.1`     |   **R570**    | `570.133.08`       | `570.133.07` | `572.83`       |    April 2025 |    March 2026 |
+| `2.x`               |    `19.0`     |   **R580**    | `580.65.05`        | `580.65.06`  | `580.88`       |   August 2025 |     July 2028 |
-|                     |    `18.0`     |   **R570**    | `570.124.03`       | `570.124.06` | `572.60`       |    March 2025 |    March 2026 |
+| `2.x`               |    `18.4`     |   **R570**    | `570.172.07`       | `570.172.08` | `573.48`       |     July 2025 |    March 2026 |
+|                     |    `18.3`     |   **R570**    | `570.158.02`       | `570.158.01` | `573.36`       |     June 2025 |               |
+|                     |    `18.2`     |   **R570**    | `570.148.06`       | `570.148.08` | `573.07`       |      May 2025 |               |
+|                     |    `18.1`     |   **R570**    | `570.133.08`       | `570.133.07` | `572.83`       |    April 2025 |               |
+|                     |    `18.0`     |   **R570**    | `570.124.03`       | `570.124.06` | `572.60`       |    March 2025 |               |
 | `1.x` & `2.x`       |    `17.6`     |   **R550**    | `550.163.02`       | `550.63.01`  | `553.74`       |    April 2025 |     June 2025 |
 |                     |    `17.5`     |               | `550.144.02`       | `550.144.03` | `553.62`       |  January 2025 |               |
 |                     |    `17.4`     |               | `550.127.06`       | `550.127.05` | `553.24`       |  October 2024 |               |
@@ -765,7 +899,7 @@ Successfully tested with this package versions.
 |                     |    `17.2`     |               | `550.90.05`        | `550.90.07`  | `552.55`       |     June 2024 |               |
 |                     |    `17.1`     |               | `550.54.16`        | `550.54.15`  | `551.78`       |    March 2024 |               |
 |                     |    `17.0`     |   **R550**    | `550.54.10`        | `550.54.14`  | `551.61`       | February 2024 |               |
-| `1.x`               |    `16.10`    |   **R535**    | `535.247.02`       | `535.247.01` | `539.28`       |    April 2025 |     July 2026 |
+| `1.x`               |    `16.11`    |   **R535**    | `535.261.04`       | `535.261.03` | `539.41`       |     July 2025 |     July 2026 |
 | `1.x`               |    `15.4`     |   **R525**    | `525.147.01`       | `525.147.05` | `529.19`       |     June 2023 | December 2023 |
 | `1.x`               |    `14.4`     |   **R510**    | `510.108.03`       | `510.108.03` | `514.08`       | December 2022 | February 2023 |
 
@@ -791,6 +925,6 @@ Special thanks to:
 - `Krutav Shah` who wrote the [vGPU_Unlock Wiki](https://docs.google.com/document/d/1pzrWJ9h-zANCtyqRgS7Vzla0Y8Ea2-5z2HEi4X75d2Q/)
 - `Wim van 't Hoog` for the [Proxmox All-In-One Installer Script](https://wvthoog.nl/proxmox-vgpu-v3/)
 - `mrzenc` who wrote [fastapi-dls-nixos](https://github.com/mrzenc/fastapi-dls-nixos)
-- `electricsheep49` who wrote [gridd-unlock-patcher](https://git.collinwebdesigns.de/oscar.krause/gridd-unlock-patcher)
+- `electricsheep49` who wrote [gridd-unlock-patcher](https://git.collinwebdesigns.de/vgpu/gridd-unlock-patcher)
 
 And thanks to all people who contributed to all these libraries!

ROADMAP.md

@@ -2,6 +2,17 @@
 
 I am planning to implement the following features in the future.
 
+## Patching Endpoint
+
+A (optional) Path-Variable to `gridd-unlock-patcher` which enables an additional endpoint.
+Here you can upload your `nvidia-gridd` binary or `nvxdapix.dll` which then will be patched and responded.
+
+## All-In-One Installer Script Endpoint
+
+A new all-in-one installer endpoint
+(here a script is returned for linux or windows which then could be called like
+curl https://<fastapi-dls>/-/install/deb | sh which then
+download and place a client-token in the right directory, patch your girdd / dll and restart nvidia-gridd service)
 
 ## HA - High Availability
 

app/main.py

@@ -5,8 +5,8 @@ from contextlib import asynccontextmanager
 from datetime import datetime, timedelta, UTC
 from hashlib import sha256
 from json import loads as json_loads, dumps as json_dumps
-from os import getenv as env
+from os import getenv as env, listdir
-from os.path import join, dirname
+from os.path import join, dirname, isfile, isdir, exists
 from textwrap import wrap
 from uuid import uuid4
 
@@ -14,9 +14,9 @@ from dateutil.relativedelta import relativedelta
 from dotenv import load_dotenv
 from fastapi import FastAPI
 from fastapi.requests import Request
+from fastapi.staticfiles import StaticFiles
 from fastapi.responses import Response, RedirectResponse, StreamingResponse
-from jose import jws, jwk, jwt, JWTError
+import jwt
-from jose.constants import ALGORITHMS
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 from starlette.middleware.cors import CORSMiddleware
@@ -50,6 +50,7 @@ LEASE_RENEWAL_PERIOD = float(env('LEASE_RENEWAL_PERIOD', 0.15))
 LEASE_RENEWAL_DELTA = timedelta(days=int(env('LEASE_EXPIRE_DAYS', 90)), hours=int(env('LEASE_EXPIRE_HOURS', 0)))
 CLIENT_TOKEN_EXPIRE_DELTA = relativedelta(years=12)
 CORS_ORIGINS = str(env('CORS_ORIGINS', '')).split(',') if (env('CORS_ORIGINS')) else [f'https://{DLS_URL}']
+DRIVERS_DIR = env('DRIVERS_DIR', None)
 DT_FORMAT = '%Y-%m-%dT%H:%M:%S.%fZ'
 PRODUCT_MAPPING = ProductMapping(filename=join(dirname(__file__), 'static/product_mapping.json'))
 
@@ -63,8 +64,8 @@ my_si_certificate = Cert.from_file(ca_setup.si_certificate_filename)
 my_si_private_key = PrivateKey.from_file(ca_setup.si_private_key_filename)
 my_si_public_key = my_si_private_key.public_key()
 
-jwt_encode_key = jwk.construct(my_si_private_key.pem(), algorithm=ALGORITHMS.RS256)
+jwt_encode_key = my_si_private_key.pem()  # todo: replace directly in code
-jwt_decode_key = jwk.construct(my_si_private_key.public_key().pem(), algorithm=ALGORITHMS.RS256)
+jwt_decode_key = my_si_private_key.public_key().pem()  # todo: replace directly in code
 
 # Logging
 LOG_LEVEL = logging.DEBUG if DEBUG else logging.INFO
@@ -100,6 +101,9 @@ async def lifespan(_: FastAPI):
 config = dict(openapi_url=None, docs_url=None, redoc_url=None)  # dict(openapi_url='/-/openapi.json', docs_url='/-/docs', redoc_url='/-/redoc')
 app = FastAPI(title='FastAPI-DLS', description='Minimal Delegated License Service (DLS).', version=VERSION, lifespan=lifespan, **config)
 
+if DRIVERS_DIR is not None:
+    app.mount('/-/static-drivers', StaticFiles(directory=str(DRIVERS_DIR), html=False), name='drivers')
+
 app.debug = DEBUG
 app.add_middleware(
     CORSMiddleware,
@@ -114,7 +118,9 @@ app.add_middleware(
 def __get_token(request: Request) -> dict:
     authorization_header = request.headers.get('authorization')
     token = authorization_header.split(' ')[1]
-    return jwt.decode(token=token, key=jwt_decode_key, algorithms=ALGORITHMS.RS256, options={'verify_aud': False})
+
+    # return jwt.decode(token=token, key=jwt_decode_key, algorithms=ALGORITHMS.RS256, options={'verify_aud': False})
+    return jwt.decode(jwt=token, key=jwt_decode_key, algorithms=['RS256'], options={'verify_aud': False})
 
 
 # Endpoints
@@ -206,6 +212,25 @@ async def _manage(request: Request):
     return Response(response, media_type='text/html', status_code=200)
 
 
+@app.get('/-/drivers/{directory:path}', summary='* List drivers directory')
+async def _drivers(request: Request, directory: str | None):
+    if DRIVERS_DIR is None:
+        return Response(status_code=404, content=f'Variable "DRIVERS_DIR" not set.')
+
+    path = join(DRIVERS_DIR, directory)
+
+    if not exists(path) and not isfile(path):
+        return Response(status_code=404, content=f'Resource "{path}" not found!')
+
+    content = [{
+        "type": "file" if isfile(f'{path}/{_}') else "folder" if isdir(f'{path}/{_}') else "unknown",
+        "name": _,
+        "link": f'/-/static-drivers/{directory}{_}',
+    } for _ in listdir(path)]
+
+    return Response(content=json_dumps({"directory": path, "content": content}), media_type='application/json', status_code=200)
+
+
 @app.get('/-/origins', summary='* Origins')
 async def _origins(request: Request, leases: bool = False):
     session = sessionmaker(bind=db)()
@@ -295,9 +320,11 @@ async def _client_token():
         },
     }
 
-    content = jws.sign(payload, key=jwt_encode_key, headers=None, algorithm=ALGORITHMS.RS256)
+    # content = jws.sign(payload, key=jwt_encode_key, headers=None, algorithm=ALGORITHMS.RS256)
+    content = jwt.encode(payload=payload, key=jwt_encode_key, headers=None, algorithm='RS256')
 
-    response = StreamingResponse(iter([content]), media_type="text/plain")
+    # response = StreamingResponse(iter([content]), media_type="text/plain")
+    response = StreamingResponse(iter(content), media_type="text/plain")
     filename = f'client_configuration_token_{datetime.now().strftime("%d-%m-%y-%H-%M-%S")}.tok'
     response.headers["Content-Disposition"] = f'attachment; filename={filename}'
 
@@ -386,7 +413,8 @@ async def auth_v1_code(request: Request):
         'kid': SITE_KEY_XID
     }
 
-    auth_code = jws.sign(payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256)
+    # auth_code = jws.sign(payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256)
+    auth_code = jwt.encode(payload=payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm='RS256')
 
     response = {
         "auth_code": auth_code,
@@ -404,8 +432,9 @@ async def auth_v1_token(request: Request):
     j, cur_time = json_loads((await request.body()).decode('utf-8')), datetime.now(UTC)
 
     try:
-        payload = jwt.decode(token=j.get('auth_code'), key=jwt_decode_key, algorithms=ALGORITHMS.RS256)
+        #payload = jwt.decode(token=j.get('auth_code'), key=jwt_decode_key, algorithms=ALGORITHMS.RS256)
-    except JWTError as e:
+        payload = jwt.decode(jwt=j.get('auth_code'), key=jwt_decode_key, algorithms=['RS256'])
+    except jwt.PyJWTError as e:
         response = {'status': 400, 'title': 'invalid token', 'detail': str(e)}
         return Response(content=json_dumps(response), media_type='application/json', status_code=400)
 
@@ -431,7 +460,7 @@ async def auth_v1_token(request: Request):
         'origin_ref': origin_ref,
     }
 
-    auth_token = jwt.encode(new_payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256)
+    auth_token = jwt.encode(payload=new_payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm='RS256')
 
     response = {
         "auth_token": auth_token,
@@ -470,8 +499,9 @@ async def leasing_v1_config_token(request: Request):
         },
     }
 
-    my_jwt_encode_key = jwk.construct(my_si_private_key.pem().decode('utf-8'), algorithm=ALGORITHMS.RS256)
+    # my_jwt_encode_key = jwk.construct(my_si_private_key.pem().decode('utf-8'), algorithm=ALGORITHMS.RS256)
-    config_token = jws.sign(payload, key=my_jwt_encode_key, headers=None, algorithm=ALGORITHMS.RS256)
+    # config_token = jws.sign(payload, key=my_jwt_encode_key, headers=None, algorithm=ALGORITHMS.RS256)
+    config_token = jwt.encode(payload=payload, key=jwt_encode_key, headers=None, algorithm='RS256')
 
     response_ca_chain = my_ca_certificate.pem().decode('utf-8').strip()
 
@@ -702,7 +732,7 @@ async def leasing_v1_lessor_shutdown(request: Request):
     j, cur_time = json_loads((await request.body()).decode('utf-8')), datetime.now(UTC)
 
     token = j.get('token')
-    token = jwt.decode(token=token, key=jwt_decode_key, algorithms=ALGORITHMS.RS256, options={'verify_aud': False})
+    token = jwt.decode(jwt=token, key=jwt_decode_key, algorithms='RS256', options={'verify_aud': False})
     origin_ref = token.get('origin_ref')
 
     released_lease_list = list(map(lambda x: x.lease_ref, Lease.find_by_origin_ref(db, origin_ref)))

requirements.txt

@@ -1,8 +1,8 @@
-fastapi==0.115.12
+fastapi==0.116.1
-uvicorn[standard]==0.34.2
+uvicorn[standard]==0.35.0
-python-jose[cryptography]==3.4.0
+pyjwt==2.10.1
-cryptography==44.0.3
+cryptography==45.0.6
 python-dateutil==2.9.0
-sqlalchemy==2.0.40
+sqlalchemy==2.0.43
-markdown==3.8
+markdown==3.8.2
-python-dotenv==1.1.0
+python-dotenv==1.1.1

test/main.py

@@ -4,13 +4,13 @@ from base64 import b64encode as b64enc
 from calendar import timegm
 from datetime import datetime, UTC
 from hashlib import sha256
+from json import loads as json_loads, dumps as json_dumps
 from uuid import uuid4, UUID
 
 from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15
 from cryptography.hazmat.primitives.hashes import SHA256
 from dateutil.relativedelta import relativedelta
-from jose import jwt, jwk, jws
+import jwt
-from jose.constants import ALGORITHMS
 from starlette.testclient import TestClient
 
 # add relative path to use packages as they were in the app/ dir
@@ -38,12 +38,12 @@ my_si_public_key = my_si_private_key.public_key()
 my_si_public_key_as_pem = my_si_private_key.public_key().pem()
 my_si_certificate = Cert.from_file(ca_setup.si_certificate_filename)
 
-jwt_encode_key = jwk.construct(my_si_private_key_as_pem, algorithm=ALGORITHMS.RS256)
+jwt_encode_key = my_si_private_key.pem()
-jwt_decode_key = jwk.construct(my_si_public_key_as_pem, algorithm=ALGORITHMS.RS256)
+jwt_decode_key = my_si_private_key.public_key().pem()
-
 
 def __bearer_token(origin_ref: str) -> str:
-    token = jwt.encode({"origin_ref": origin_ref}, key=jwt_encode_key, algorithm=ALGORITHMS.RS256)
+    # token = jwt.encode({"origin_ref": origin_ref}, key=jwt_encode_key, algorithm=ALGORITHMS.RS256)
+    token = jwt.encode(payload={"origin_ref": origin_ref}, key=jwt_encode_key, algorithm='RS256')
     token = f'Bearer {token}'
     return token
 
@@ -145,12 +145,12 @@ def test_config_token():
     assert nv_si_certificate.public_key().mod() == nv_response_public_key.get('mod')[0]
     assert nv_si_certificate.authority_key_identifier() == nv_ca_chain.subject_key_identifier()
 
-    nv_jwt_decode_key = jwk.construct(nv_response_public_cert, algorithm=ALGORITHMS.RS256)
+    # nv_jwt_decode_key = jwk.construct(nv_response_public_cert, algorithm=ALGORITHMS.RS256)
 
     nv_response_config_token = response.json().get('configToken')
 
-    payload = jws.verify(nv_response_config_token, key=nv_jwt_decode_key, algorithms=ALGORITHMS.RS256)
+    #payload = jws.verify(nv_response_config_token, key=nv_jwt_decode_key, algorithms=ALGORITHMS.RS256)
-    payload = json.loads(payload)
+    payload = jwt.decode(jwt=nv_response_config_token, key=nv_si_certificate.public_key().pem(), algorithms=['RS256'], options={'verify_signature': False})
     assert payload.get('iss') == 'NLS Service Instance'
     assert payload.get('aud') == 'NLS Licensed Client'
     assert payload.get('service_instance_ref') == INSTANCE_REF
@@ -230,7 +230,7 @@ def test_auth_v1_code():
     response = client.post('/auth/v1/code', json=payload)
     assert response.status_code == 200
 
-    payload = jwt.get_unverified_claims(token=response.json().get('auth_code'))
+    payload = jwt.decode(response.json().get('auth_code'), key=my_si_public_key_as_pem, algorithms=['RS256'])
     assert payload.get('origin_ref') == ORIGIN_REF
 
 
@@ -247,7 +247,7 @@ def test_auth_v1_token():
         "kid": "00000000-0000-0000-0000-000000000000"
     }
     payload = {
-        "auth_code": jwt.encode(payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256),
+        "auth_code": jwt.encode(payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm='RS256'),
         "code_verifier": SECRET,
     }
 
@@ -255,7 +255,7 @@ def test_auth_v1_token():
     assert response.status_code == 200
 
     token = response.json().get('auth_token')
-    payload = jwt.decode(token=token, key=jwt_decode_key, algorithms=ALGORITHMS.RS256, options={'verify_aud': False})
+    payload = jwt.decode(token, key=jwt_decode_key, algorithms=['RS256'], options={'verify_signature': False})
     assert payload.get('origin_ref') == ORIGIN_REF