authlib / joserfc

Implementations of JOSE RFCs in Python

joserfc is a Python library that provides a comprehensive implementation of several essential JSON Object Signing and Encryption (JOSE) standards.

Usage

A quick and simple JWT encoding and decoding would look something like this:

from joserfc import jwt

encoded = jwt.encode({"alg": "HS256"}, {"k": "value"}, "secret")
# 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrIjoidmFsdWUifQ.ni-MJXnZHpFB_8L9P9yllj3RNDfzmD4yBKAyefSctMY'

token = jwt.decode(encoded, "secret")
print(token.header)
# {'alg': 'HS256', 'typ': 'JWT'}
print(token.claims)
# {'k': 'value'}

Features

It follows RFCs with extensible API. The module has implementations of:

• RFC7515: JSON Web Signature
• RFC7516: JSON Web Encryption
• RFC7517: JSON Web Key
• RFC7518: JSON Web Algorithms
• RFC7519: JSON Web Token
• RFC7520: Examples of Protecting Content Using JSON Object Signing and Encryption
• RFC7638: thumbprint for JWK
• RFC7797: JSON Web Signature (JWS) Unencoded Payload Option
• RFC8037: OKP Key and EdDSA algorithm
• RFC8812: ES256K algorithm

And draft RFCs implementation of:

• C20P and XC20P
• Key Agreement with Elliptic Curve Diffie-Hellman One-Pass Unified Model

Useful Links

• Documentation: https://jose.authlib.org/
• Blog: https://blog.authlib.org/.
• Twitter: https://twitter.com/authlib.

License

2023, Hsiaoming Yang. Under BSD-3 license.

joserfc's Issues

Raise exception for expired JWTs?

One thing I noticed when migrating some existing code from PyJWT to joserfc is that PyJWT checks the expiration of the token and raises an exception (ExpiredSignatureError) if expired while joserfc currently requires you to check this manually.

Would this be a valuable feature addition for joserfc?

JWE: Message with multiple recipients requires ALL keys (instead of just one)

Setup:
Message contains two recipients
I try to decrypt the message with ONE correct key.

Error:
  File "venv/lib64/python3.12/site-packages/joserfc/jwe.py", line 254, in decrypt_json
    _attach_recipient_keys(general_obj.recipients, private_key, sender_key)
  File "venv/lib64/python3.12/site-packages/joserfc/jwe.py", line 269, in _attach_recipient_keys
    key = guess_key(private_key, recipient)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "venv/lib64/python3.12/site-packages/joserfc/jwk.py", line 71, in guess_key
    rv_key = _norm_key.get_by_kid(kid)
             ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "venv/lib64/python3.12/site-packages/joserfc/_keys.py", line 140, in get_by_kid
    raise ValueError(f'No key for kid: "{kid}"')
ValueError: No key for kid: "FCmerznXQ1ZWdLUWhESQ0NP7r_4_RNGJSOtmNEzw-NQ"

RFC:
https://datatracker.ietf.org/doc/html/rfc7516#page-17

When there are multiple recipients, it is an application decision
which of the recipients' encrypted content must successfully validate
for the JWE to be accepted. In some cases, encrypted content for all
recipients must successfully validate or the JWE will be considered
invalid. In other cases, only the encrypted content for a single
recipient needs to be successfully validated. However, in all cases,
the encrypted content for at least one recipient MUST successfully
validate or the JWE MUST be considered invalid.

Sample Message:

{
  "protected": "eyJlbmMiOiJBMTI4R0NNIn0",
  "iv": "nMJiDqzDzwvGU-MP",
  "ciphertext": "ryF25Rj33Uo9FTFi",
  "tag": "7h58L5Umg6ulbJkpC5AK4A",
  "recipients": [
    {
      "header": {
        "alg": "ECDH-ES+A128KW",
        "kid": "xsM1h0SZiMZTQHYRdGINj-RWnqQ1tzehgmqN8PqF7NQ",
        "epk": {
          "crv": "P-256",
          "x": "WrJMwjpg1zXDLxkVm1KPsxHaEJPRaGwkGRCc8dyG2Kk",
          "y": "PEB1MonzgxB2nXJNyCJ3Gh3vJ68tjUNeVmE9v-yOupc",
          "kty": "EC"
        }
      },
      "encrypted_key": "fV4kYX4axHBqlKyiER4akpzLw9DB4gTs"
    },
    {
      "header": {
        "alg": "ECDH-ES+A128KW",
        "kid": "FCmerznXQ1ZWdLUWhESQ0NP7r_4_RNGJSOtmNEzw-NQ",
        "epk": {
          "crv": "P-256",
          "x": "uthnacJYi9cuMa40ecBNZeFTSaRtKhd-aGZDO0k4kGY",
          "y": "6lklVzYoBIDRLwmMXJPuZ6R3MhzX-aMlvDnAS0lByxg",
          "kty": "EC"
        }
      },
      "encrypted_key": "qwrB-IYpJ6QKUDEd9x7yJ8PkyUp4Z130"
    }
  ]
}

Code:

private.pem and private.pem.bak contain one of the two keys each.

import json

import joserfc.jwk
import joserfc.jwe

with open("private.pem", "r") as f:
    private_pem="".join(f.readlines())

print(private_pem)

key1=joserfc.jwk.ECKey.import_key(private_pem)
key1.ensure_kid()


with open("private.pem.bak", "r") as f:
    private_pem="".join(f.readlines())

key2=joserfc.jwk.ECKey.import_key(private_pem)
key2.ensure_kid()

with open("message.enc", "r") as f:
    message="".join(f.readlines())

msg=json.loads(message)

print(joserfc.jwk.KeySet([key1]).as_dict())

print("key1:")
plaintext=joserfc.jwe.decrypt_json(msg, joserfc.jwk.KeySet([key1]))
print(plaintext.plaintext)

print("key2:")
plaintext=joserfc.jwe.decrypt_json(msg, joserfc.jwk.KeySet([key2]))
print(plaintext.plaintext)

ValueError: This key may not be safe to import when decoding RS256 encoded JWT

When I use JWT decoding with a RS256 encoded pub key:

jwt.decode(token, pub_key)

I get *** ValueError: This key may not be safe to import. This seems to originate in import_from_bytes which checks the key prefix against this constant.

Since -----BEGIN is in this list, it seems like no PEM-formatted keys would work with joserfc?

This key works fine with PyJWT and I'm a bit confused by what the problem is. What is the risk here?

Thanks!

jwt.encode shouldn't hardcode header `typ` as 'JWT'

It took me awhile to finally track down the source of a subtle bug that appeared when I started to use this library to generate and validate dpop proof tokens (a form of jwt).

The token header and claims look something like this

{
	"typ": "dpop+jwt",
	"alg": "ES256",
	"jwk": {
		"keys": [
			{
				"crv": "P-256",
				"x": "d_gYGcjbItA5JZ1yDo8Jrsx05NFZKiWbddM1a7GrqVE",
				"y": "jNHKYu6Lg9e9oxpHxs-0LydXD1XGmTV94g6IH78tMOI",
				"kty": "EC",
				"kid": "rma_Eq5FqSUgKkh8Fkd6uZw8Nv6hirCyH1iNsKet4pQ"
			}
		]
	}
}
.
{
    "htm": "POST",
    "htu": "/v1/auth/device/1234/review",
    "jti": "c618fcc6-a83f-4198-9c83-647e3aef6a00",
    "iat": 1689702506,
    "exp": 1689706106
}

When I attempt to encode this token with jwt.encode and then decode it, the header has been altered (in place too, an original reference to the header dict now has the 'typ' key changed to 'JWT').

It would seem this line at the top of encode is the culprit https://github.com/authlib/joserfc/blob/main/src/joserfc/jwt.py#L61

    # add ``typ`` in header
    header["typ"] = "JWT"

I can't tell you how excited I was to learn this library existed not long ago, Python has been sorely lacking a clean, no bs, pythonic jose implementation. But this hardcoded typ makes it impossible to use for one of my use cases (one of which is dpop validation) because I'm unable to generate test case material at runtime.

I understand not wanting to support a draft spec until its at least more mature, but I think at this point, dpop is here to stay and my ask would only be adding some flexibility in order to make such a use case possible. So my question is, how best can I scratch my own itch here? What kind of change would you accept in PR form to open up the typ value a bit? Initially, I was thinking 'typ' could be something that can be overrided in JWSRegistry kinda like registering custom header claims. What do you think?

Thanks for the great library and your time btw!

With the latest update (0.7.0), kid disappeared.

Example

key = JWKRegistry.generate_key("RSA", 2048, {"use": "sig"})
key_as_dict = key.as_dict(private=False)

assert "kid" in key_as_dict

How to return a kid?

Decode error due to invalid typ header

I noticed the following behavior while trying to validate third party produced tokens. It seems that the only allowed value for the typ header is jwt. This is due to the following https://github.com/authlib/joserfc/blob/main/src/joserfc/jwt.py#L109

I feel this is contradictory with the assessment made for the following older issue , which allowed a more free form typ header. At any rate if we can encode a jwt with typ other than jwt , we should be able to decode the generated jwt.

Can you maybe validate typ header as a string with a reasonable max length instead ? or maybe accept any string with "mime type format" as valid. This make sens as , according to https://www.rfc-editor.org/rfc/rfc7519#section-5.1 :

The "typ" (type) Header Parameter defined by [[JWS](https://www.rfc-editor.org/rfc/rfc7519#ref-JWS)] 
and [[JWE](https://www.rfc-editor.org/rfc/rfc7519#ref-JWE)] is used by JWT applications to declare 
the media type [[IANA.MediaTypes](https://www.rfc-editor.org/rfc/rfc7519#ref-IANA.MediaTypes)] 
of this complete JWT.

I would be happy to make a PR in this direction.

[jwk] please add key type attribute/method

Hi,

It would be great if the jwk key object will know what type it is so we could have something like:

        token = joserfc.jwt.encode(
            header={
-               "alg": "RS256",  # guess
+               "alg": jwk1.alg(),
                "kid": jwk1.thumbprint(),
            },
            claims=claims,
            key=jwk1,
        )

It was also missing in authlib.

I tried to use jwk1.get("alg") but this returns None in most of the cases, I am unsure where is the right place to add this.

Thanks!

Design registry

Low level registry keeps its mapping class in instance, while high level registry keeps them in class.

sphinx warnings `reference target not found`

First of all currently it is not possible to use straight sphinx-build command to build documentation out of source tree

+ /usr/bin/sphinx-build -n -T -b man docs build/sphinx/man
Running Sphinx v7.1.2

Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/sphinx/config.py", line 356, in eval_config_file
    exec(code, namespace)  # NoQA: S102
  File "/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/docs/conf.py", line 1, in <module>
    from joserfc import __version__
ModuleNotFoundError: No module named 'joserfc'

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/sphinx/cmd/build.py", line 285, in build_main
    app = Sphinx(args.sourcedir, args.confdir, args.outputdir,
  File "/usr/lib/python3.8/site-packages/sphinx/application.py", line 207, in __init__
    self.config = Config.read(self.confdir, confoverrides or {}, self.tags)
  File "/usr/lib/python3.8/site-packages/sphinx/config.py", line 179, in read
    namespace = eval_config_file(filename, tags)
  File "/usr/lib/python3.8/site-packages/sphinx/config.py", line 369, in eval_config_file
    raise ConfigError(msg % traceback.format_exc()) from exc
sphinx.errors.ConfigError: There is a programmable error in your configuration file:

Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/sphinx/config.py", line 356, in eval_config_file
    exec(code, namespace)  # NoQA: S102
  File "/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/docs/conf.py", line 1, in <module>
    from joserfc import __version__
ModuleNotFoundError: No module named 'joserfc'

This can be fixed by patch like below:

--- a/docs/conf.py
+++ b/docs/conf.py
@@ -1,3 +1,7 @@
+import sys
+import os
+sys.path.insert(0, os.path.abspath("../src"))
+
 from joserfc import __version__

 project = "joserfc"

This patch fixes what is in the comment and that can of fix is suggested in sphinx example copy.py https://www.sphinx-doc.org/en/master/usage/configuration.html#example-of-configuration-file

Than .. on building my packages I'm using sphinx-build command with -n switch which shows warmings about missing references. These are not critical issues.

+ /usr/bin/sphinx-build -n -T -b man docs build/sphinx/man
Running Sphinx v7.1.2
making output directory... done
building [mo]: targets for 0 po files that are out of date
writing output...
building [man]: all manpages
updating environment: [new config] 28 added, 0 changed, 0 removed
reading sources... [100%] stability
looking for now-outdated files... none found
pickling environment... done
checking consistency... done
writing... joserfc.1 { guide/introduction install guide/index guide/jwk guide/jwt guide/jws guide/jwe guide/algorithms guide/registry migrations/index migrations/authlib migrations/pyjwt recipes/azure recipes/openssl api/index api/jws api/jwe api/jwk api/jwt security stability contributing/index contributing/structure contributing/translation contributing/authors contributing/sponsors changelog } /home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/docs/guide/jws.rst:168: WARNING: py:class reference target not found: jwk.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/docs/guide/algorithms.rst:216: WARNING: py:class reference target not found: joserfc.jwk.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7515/registry.py:docstring of joserfc.rfc7515.registry.JWSRegistry:1: WARNING: py:class reference target not found: joserfc.registry.HeaderParameter
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_compact:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.deserialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.detach_content:1: WARNING: py:class reference target not found: joserfc.jws.DetachValue
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.detach_content:1: WARNING: py:class reference target not found: joserfc.jws.DetachValue
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_compact:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.serialize_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.validate_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.validate_compact:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jws.py:docstring of joserfc.jws.validate_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry:1: WARNING: py:class reference target not found: joserfc.registry.HeaderParameter
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry.get_alg:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.JWEKeyEncryption
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry.get_alg:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.JWEKeyWrapping
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry.get_alg:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.JWEKeyAgreement
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry.get_alg:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.JWEDirectEncryption
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry.get_enc:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.JWEEncModel
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/registry.py:docstring of joserfc.rfc7516.registry.JWERegistry.get_zip:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.JWEZipModel
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7516/models.py:docstring of joserfc.rfc7516.models.Recipient:1: WARNING: py:class reference target not found: joserfc.rfc7516.models.KeyType
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_compact:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_json:1: WARNING: py:class reference target not found: joserfc.rfc7516.types.GeneralJSONSerialization
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_json:1: WARNING: py:class reference target not found: joserfc.rfc7516.types.FlattenedJSONSerialization
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.decrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_compact:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_compact:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc.rfc7516.types.GeneralJSONSerialization
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwe.py:docstring of joserfc.jwe.encrypt_json:1: WARNING: py:class reference target not found: joserfc.rfc7516.types.FlattenedJSONSerialization
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/ec_key.py:docstring of joserfc.rfc7518.ec_key.ECKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePrivateKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/ec_key.py:docstring of joserfc.rfc7518.ec_key.ECKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePublicKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/ec_key.py:docstring of joserfc.rfc7518.ec_key.ECKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/ec_key.py:docstring of joserfc.rfc7518.ec_key.ECKey.generate_key:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/ec_key.py:docstring of joserfc.jwk.ECKey.value_registry:1: WARNING: py:class reference target not found: joserfc.registry.KeyParameter
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/_keys.py:docstring of joserfc._keys.JWKRegistry.generate_key:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/_keys.py:docstring of joserfc._keys.JWKRegistry.import_key:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc8037/okp_key.py:docstring of joserfc.rfc8037.okp_key.OKPKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePrivateKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc8037/okp_key.py:docstring of joserfc.rfc8037.okp_key.OKPKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePublicKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc8037/okp_key.py:docstring of joserfc.rfc8037.okp_key.OKPKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc8037/okp_key.py:docstring of joserfc.rfc8037.okp_key.OKPKey.generate_key:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc8037/okp_key.py:docstring of joserfc.jwk.OKPKey.value_registry:1: WARNING: py:class reference target not found: joserfc.registry.KeyParameter
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/oct_key.py:docstring of joserfc.rfc7518.oct_key.OctKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePrivateKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/oct_key.py:docstring of joserfc.rfc7518.oct_key.OctKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePublicKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/oct_key.py:docstring of joserfc.rfc7518.oct_key.OctKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/oct_key.py:docstring of joserfc.rfc7518.oct_key.OctKey.generate_key:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/oct_key.py:docstring of joserfc.jwk.OctKey.value_registry:1: WARNING: py:class reference target not found: joserfc.registry.KeyParameter
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/rsa_key.py:docstring of joserfc.rfc7518.rsa_key.RSAKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePrivateKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/rsa_key.py:docstring of joserfc.rfc7518.rsa_key.RSAKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.models.NativePublicKey
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/rsa_key.py:docstring of joserfc.rfc7518.rsa_key.RSAKey:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/rsa_key.py:docstring of joserfc.rfc7518.rsa_key.RSAKey.generate_key:1: WARNING: py:class reference target not found: joserfc.rfc7517.types.KeyParameters
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/rfc7518/rsa_key.py:docstring of joserfc.jwk.RSAKey.value_registry:1: WARNING: py:class reference target not found: joserfc.registry.KeyParameter
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwk.py:docstring of joserfc.jwk.guess_key:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwk.py:docstring of joserfc.jwk.guess_key:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwk.py:docstring of joserfc.jwk.guess_key:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwk.py:docstring of joserfc.jwk.guess_key:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwt.py:docstring of joserfc.jwt.decode:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwt.py:docstring of joserfc.jwt.decode:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwt.py:docstring of joserfc.jwt.decode:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwt.py:docstring of joserfc.jwt.encode:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwt.py:docstring of joserfc.jwt.encode:1: WARNING: py:class reference target not found: joserfc.jwk.GuestProtocol
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/src/joserfc/jwt.py:docstring of joserfc.jwt.encode:1: WARNING: py:class reference target not found: joserfc._keys.KeySet
/home/tkloczko/rpmbuild/BUILD/joserfc-0.9.0/docs/changelog.rst:39: WARNING: py:class reference target not found: jwk.KeySet
done
build succeeded, 91 warnings.

You can peak on fixes that kind of issues in other projects
RDFLib/rdflib-sqlalchemy#95
RDFLib/rdflib#2036
click-contrib/sphinx-click@abc31069
frostming/unearth#14
jaraco/cssutils#21
latchset/jwcrypto#289
latchset/jwcrypto#289
pypa/distlib@98b9b89f
pywbem/pywbem#2895
sissaschool/elementpath@bf869d9e
sissaschool/xmlschema@42ea98f2
sqlalchemy/sqlalchemy@5e88e6e8