[PATCH proxmox-acme 1/1] fix #7749: always serialize in same order

[Thomas Ellmenreich <t.ellmenreich@proxmox.com>]

All objects are now serialized with "canonical => 1" so that the
resulting bytes are directly comparable. Perls randomized hash key
orders lead to different serialization outputs even with the same input.

Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 src/PVE/ACME.pm | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e6fb9c2..a5287ac 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -64,9 +64,9 @@ sub encode($) { # acme requires 'base64url' encoding
     return encode_base64url($_[0]);
 }
 
-sub tojs($;%) { # shortcut for to_json with utf8=>1
+sub tojs($;%) { # shortcut for to_json with utf8=>1 and canonical=>1
     my ($data, %data) = @_;
-    return to_json($data, { utf8 => 1, %data });
+    return to_json($data, { utf8 => 1, canonical => 1, %data });
 }
 
 sub fromjs($) {
@@ -155,7 +155,7 @@ sub save {
     }
     # pretty => 1 for readability
     # canonical => 1 to reduce churn
-    file_set_contents($self->{path}, tojs($o, pretty => 1, canonical => 1));
+    file_set_contents($self->{path}, tojs($o, pretty => 1));
 }
 
 # Load serialized account JSON file into $self
@@ -196,7 +196,7 @@ sub jwk {
 sub jwk_thumbprint {
     my ($self) = @_;
     my $jwk = $self->jwk(1); # $pure = 1
-    return encode(sha256(tojs($jwk, canonical => 1))); # canonical sorts
+    return encode(sha256(tojs($jwk)));
 }
 
 # A key authorization string in acme is a challenge token dot-connected with
-- 
2.47.3