gmosx / dart-json_web_token Goto Github PK

Experimenting with the firebase rest api and I noticed this:

https://github.com/gmosx/dart-json_web_token/blob/master/lib/json_web_signature.dart#L21

The library is otherwise working as expected. Cheers!

From @denchaihos on October 5, 2018 1:51

URL: https://pub.dartlang.org/packages/jwt#-versions-tab-
I use sdk version >2
when use jwt it conlick below
Running "flutter packages get" in mobile-cockpit-ket-app...
The current Dart SDK version is 2.1.0-dev.1.0.flutter-ccb16f7282.

Because kpi depends on jwt any which requires SDK version <2.0.0, version solving failed.
pub get failed (1)
Process finished with exit code 1

how to solve thank.

Copied from original issue: dart-lang/pub-dev#1673

This package no longer works with Dart 1.24 or newer.

It only works with Dart 1.23 or earlier, and it will require significant changes for it work with Dart 1.24 and newer.

Reason

This is because:

• This JWT package only works with crypto 0.9.2+1 or older;
• crypto 0.9.2+1 or older only works with convert 1.1.1 and earlier;
• convert 1.1.1 and earlier needs the ChunkedConverter class; but
• Dart 1.24 has removed the ChunkedConverter class (which has been deprecated since Dart 1.17.0).
  The Dart SDK release notes acknowledge this is a breaking change.

For Dart 1.24 to work, it would require:

• Use of convert 2.0.0 or later (which does not use the ChunkedConverter class);
• The use of convert 2.0.0 or later would require the use of crypto 1.0.0 or later (e.g. 1.0.0, 1.1.1, or 2.0.1), but
• crypto 1.0.0 or later does not work with this JWT 0.1.4 package, as it is currently written.

Error messages

The pub dependency mechanism does not give you a meaningful error message. This is because the dependencies have been incorrectly specified:

• this package's dependency on crypto: any is wrong, because that allows the newer crypto 2.0.1 which is incompatible with it;
• the convert 1.1.1 package's dependency on sdk: '>=1.16.0 <2.0.0' is wrong, because it needs the ChunkedConverter class which (in hindsight) is not available in Dart SDK 1.24.0; and
• Dart should not have introduced a breaking change (i.e. removing the ChunkedConverter class) when going from 1.23 to 1.24. It should have gone up to 2.x.x to indicate a breaking change.

Symptom 1

This is the error message you see when running pub get/update under Dart 1.24 and the overall dependencies make it use an older version of the convert package:

$ pub get
...
Failed to precompile test:test:
'package:convert/src/hex/encoder.dart': malformed type: line 20 pos 13: cannot resolve class 'ChunkedConverter' from 'HexEncoder'
    extends ChunkedConverter<List<int>, String, List<int>, String> {

This is because the older version of convert is not compatible with Dart 1.24, since it no longer supports the ChunkedConverter class.

Symptom 2

However, if the overall dependencies make it pick up a newer version of the convert package (e.g. 2.0.1 which does not use the ChunkedConverter class), the pub get/update command will work, but your program will fail with this error message:

Exception: 'package:jwt/json_web_signature.dart': malformed type: line 98 pos 29: cannot resolve class 'SHA256' from '::'
  final hmac = new HMAC(new SHA256(), secret.codeUnits);

This is because the newer version of crypto (required to work with the newer version of convert) is not compatible with this JWT package. There are many changes between the incompatible versions of crypto, but the error shown here is because the SHA256 class was renamed to Sha256.

Fix required

To get this package to work with Dart 1.24, its code needs to be changed to work with crypto 2.0.1. That newer version of crypto will use the newer version of convert which doesn't need the class that was removed from Dart 1.24.

This fix will not be easy, because there are many breaking changes from crypto 0.9.2+1 to crypto 2.0.1.

The newer versions of the crypto package (1.0.0 and newer) are incompatible with version 0.1.4 of this package.

The minimal fix is to change the pubspec.yaml to require "^0.9.2" instead of "any".

However, it would be better to update this package to work with the newer version of crypto (as well as fixing the pubspec.yaml dependency to prevent this type of problem from occurring in the future). This should mean to use the encode and decode methods of BASE64 from the dart convert package, instead of the CryptoUtils class (which was deprecated and then removed from crypto). Also changing "HMAC" to "Hmac" and "SHA256" to "Sha256" (which were renamed in crypto).

Note: until this gets fixed, a work-around is to put crypto: "^0.9.2" in the application's pubspec.yaml to ensure crypto 1.x.x does not get used.