{"record":{"id":"b2daa4d31dba7e4d","repo":"mastra-ai/mastra","slug":"unsupported-jws-algorithm-for-a2a-agent-card-signi-b2daa4","errorCode":null,"errorMessage":"Unsupported JWS algorithm for A2A Agent Card signing: ${algorithm}","messagePattern":"Unsupported JWS algorithm for A2A Agent Card signing: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/server/src/server/a2a/agent-card-signing.ts","lineNumber":71,"sourceCode":"  if (algorithm.startsWith('ES')) {\n    return { dsaEncoding: 'ieee-p1363' as const };\n  }\n\n  if (algorithm.startsWith('PS')) {\n    return {\n      padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n      saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,\n    };\n  }\n\n  return {};\n}\n\nfunction getDigestAlgorithm(algorithm: string): string {\n  if (algorithm.endsWith('256')) return 'sha256';\n  if (algorithm.endsWith('384')) return 'sha384';\n  if (algorithm.endsWith('512')) return 'sha512';\n  throw new Error(`Unsupported JWS algorithm for A2A Agent Card signing: ${algorithm}`);\n}\n\nexport async function signAgentCard({\n  agentCard,\n  signing,\n}: {\n  agentCard: AgentCard;\n  signing: A2AAgentCardSigningConfig;\n}): Promise<AgentCard> {\n  const canonicalPayload = canonicalize(stripAgentCardSignatures(agentCard));\n\n  if (!canonicalPayload) {\n    throw new Error('Failed to canonicalize A2A Agent Card for signing');\n  }\n\n  const key = importSigningKey(signing);\n  const protectedHeader = getProtectedHeader(signing);\n  const encodedHeader = Buffer.from(JSON.stringify(protectedHeader), 'utf8').toString('base64url');","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/a2a/agent-card-signing.ts#L53-L89","documentation":"getDigestAlgorithm() maps the JWS algorithm name to a Node crypto digest by suffix: names ending in 256/384/512 map to sha256/sha384/sha512. Any algorithm not ending in one of these bit sizes (since the earlier alg whitelist passed, this is mostly a defensive check for odd names) throws this error while computing the signature buffer.","triggerScenarios":"Calling signAgentCard where the resolved algorithm string does not end with '256', '384', or '512' — e.g. a custom/typo'd alg like 'ES256K' that slipped through, or direct calls with unusual algorithm identifiers.","commonSituations":"Custom algorithm aliases; misconfigured protectedHeader with truncated alg names ('ES2', 'RS'); forks/extensions adding algorithms not supported by the digest mapping.","solutions":["Use a standard alg ending in 256/384/512 (e.g. ES256, RS384, PS512).","Fix truncated or misspelled alg values in the signing config.","If a new algorithm is genuinely needed, extend getDigestAlgorithm to map it to a Node digest and update SUPPORTED_JWS_ALGORITHMS."],"exampleFix":"// before\nprotectedHeader: { alg: 'ES256K' } // no 256/384/512 suffix mapping\n// after\nprotectedHeader: { alg: 'ES256' }","handlingStrategy":"validation","validationCode":"if (!/^(ES|RS|PS)(256|384|512)$/.test(alg)) {\n  throw new Error(`Digest mapping requires alg ending in 256/384/512, got: ${alg}`);\n}","typeGuard":"const hasValidDigestSuffix = (a: string): boolean =>\n  a.endsWith('256') || a.endsWith('384') || a.endsWith('512');","tryCatchPattern":"try {\n  return await signAgentCard({ agentCard, signing });\n} catch (e) {\n  if (e.message.includes('Unsupported JWS algorithm')) {\n    console.error(`Signing alg '${signing.protectedHeader.alg}' has no digest mapping`);\n  }\n  throw e;\n}","preventionTips":["Use standard RFC 7518 algorithm names only.","Validate alg strings at config load time with a strict regex.","Avoid custom/truncated algorithm aliases."],"tags":["jws","a2a","crypto"],"backgroundTag":"unsupported-jws-algorithm","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}