[asterisk-dev] libjwt is being added to the 'third-party' packages (Attention Asterisk Package Maintainers!)

[George Joseph]

With our effort to harden Asterisk's STIR/SHAKEN implementation, we're
adding a new package (libjwt: JSON WebToken) to the third-party directory
next to jansson and pjproject.  Using libjwt allows us to remove the custom
code (which isn't reliable) in res_stir_shaken that handles the assembly of
the JWT and associated signature process that STIR/SHAKEN relies upon and
delegate that to libjwt.  We're including it in third-party because some
distros don't include that package and those that do are several releases
behind the latest.  The minimum supported version will be 1.15.3 which is
the current libjwt version.

Since libjwt will be only used by res_stir_shaken at this time, it's not a
hard requirement to build asterisk as a whole and isn't included in the
install_prereq script.  If you want to build res_stir_shaken however, your
build system must have libjwt >= 1.15.3 installed or you'll need to specify
'--with-libjwt-bundled' on the ./configure command line.  As with jansson
and pjproject, you can pre-download the libjwt tarball (
https://raw.githubusercontent.com/asterisk/third-party/master/libjwt/1.15.3/libjwt-1.15.3.tar.gz)
and use the '--with-download-cache' configure option to point to the
directory containing the tarball.

We are planning this change for the next releases of Asterisk 18 and 20 and
the first release of Asterisk 21.

-- 
George Joseph
Asterisk Software Developer
Sangoma Technologies
Check us out at www.sangoma.com and www.asterisk.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20230926/163d7aa7/attachment.html>