{"record":{"id":"6c93d6c1152c6be6","repo":"Pumpkin-MC/Pumpkin","slug":"public-key-build-failed-0","errorCode":null,"errorMessage":"Public key build failed: {0}","messagePattern":"Public key build failed: (.+?)","errorType":"error_code","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-auth/src/jwt/mod.rs","lineNumber":45,"sourceCode":"}\n\n/// Represents the possible errors that can occur during JWT verification.\n#[derive(Debug, Error)]\npub enum AuthError {\n    /// Indicates that a JWT token has an invalid format (not enough parts).\n    #[error(\"Invalid token format\")]\n    InvalidTokenFormat,\n    /// Indicates that the 'x5u' (X.509 URL) header parameter is missing from a token.\n    #[error(\"x5u not found in header\")]\n    MissingX5U,\n    /// Indicates a failure in Base64 decoding.\n    #[error(\"Base64 decoding failed: {0}\")]\n    Base64Decode(#[from] base64::DecodeError),\n    /// Indicates a failure in parsing JSON data.\n    #[error(\"JSON parse error: {0}\")]\n    JsonParse(#[from] serde_json::Error),\n    /// Indicates a failure in building a public key from its representation.\n    #[error(\"Public key build failed: {0}\")]\n    PublicKeyBuild(String),\n    /// Indicates that the token was not signed by the trusted Mojang public key.\n    #[error(\"Token not signed by trusted Mojang key\")]\n    MojangKeyMismatch,\n    /// Indicates that the token's signature is invalid.\n    #[error(\"Invalid signature\")]\n    InvalidSignature,\n    /// Indicates an error related to ECDSA signature operations.\n    #[error(\"ECDSA signature error: {0}\")]\n    Ecdsa(#[from] ecdsa::Error),\n}\n\n/// Decodes a Base64 URL-safe encoded string with no padding.\n///\n/// # Arguments\n///\n/// * `s` - The Base64 URL-safe encoded string to decode.\n///","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-auth/src/jwt/mod.rs#L27-L63","documentation":"This variant indicates the library failed to construct a public key (e.g. an RSA or EC point) from its encoded representation while validating a Mojang-signed JWT. Unlike the #[from] variants, it carries a manually supplied String, meaning code explicitly chose this error when key-building (e.g. p256/rsa decoding) failed. It signals the token's embedded key material is invalid or unsupported.","triggerScenarios":"Decoding the x5u/encoded public key from a JWT header and calling key-construction APIs (e.g. VerifyingKey::from_sec1_bytes, RsaPublicKey::new) on bytes that are not a valid key encoding.","commonSituations":"Forged or modified clients embedding garbage in the token header; a Mojang crypto format change; feeding DER bytes where raw SEC1 point bytes are expected (or vice versa).","solutions":["Log the wrapped String message to see which key-construction step failed","Ensure the key bytes are extracted from the correct Base64 URL-safe field (x5u) before key construction","Use the matching decoder for the key format (SEC1/DER/PEM) expected by the crypto crate version","Reject authentication for the client; an unparseable embedded key means the token cannot be trusted"],"exampleFix":"// before\nlet key = VerifyingKey::<NistP256>::from_sec1_bytes(&bytes)\n    .map_err(|e| AuthError::PublicKeyBuild(e.to_string()))?;\n// after\nif bytes.len() != 65 || bytes[0] != 0x04 {\n    return Err(AuthError::PublicKeyBuild(\"unexpected key encoding\".into()));\n}\nlet key = VerifyingKey::<NistP256>::from_sec1_bytes(&bytes)\n    .map_err(|e| AuthError::PublicKeyBuild(e.to_string()))?;","handlingStrategy":"validation","validationCode":"// check expected raw SEC1 P-256 point encoding (0x04 || 32 || 32 = 65 bytes)\nfn key_bytes_look_valid(bytes: &[u8]) -> bool {\n    bytes.len() == 65 && bytes[0] == 0x04\n}","typeGuard":null,"tryCatchPattern":"match jwt::parse(&token) {\n    Err(jwt::Error::PublicKeyBuild(msg)) => {\n        log::warn!(\"client sent unparseable public key: {msg}; rejecting\");\n    }\n    r => r?,\n}","preventionTips":["Decode the x5u header field with URL-safe Base64 before key construction","Match the decoder to the key format expected by your crypto crate version","Never accept hand-crafted tokens; reject clients whose embedded key cannot be built"],"tags":["jwt","public-key","cryptography","authentication","rust"],"backgroundTag":"invalid-argument-format","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}