Re: [PATCH proxmox-acme 1/1] fix #7749: always serialize in same order

["Elias Huhsovitz" <e.huhsovitz@proxmox.com>]

Small nit below, otherwise

Reviewed-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>

On Tue Jul 14, 2026 at 11:04 AM CEST, Thomas Ellmenreich wrote:
> All objects are now serialized with "canonical => 1" so that the
> resulting bytes are directly comparable. Perls randomized hash key
> orders lead to different serialization outputs even with the same input.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
>  src/PVE/ACME.pm | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..a5287ac 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -64,9 +64,9 @@ sub encode($) { # acme requires 'base64url' encoding
>      return encode_base64url($_[0]);
>  }
>  
> -sub tojs($;%) { # shortcut for to_json with utf8=>1
> +sub tojs($;%) { # shortcut for to_json with utf8=>1 and canonical=>1
>      my ($data, %data) = @_;
> -    return to_json($data, { utf8 => 1, %data });
> +    return to_json($data, { utf8 => 1, canonical => 1, %data });
>  }

nit: change the ordering to:

return to_json($data, { %data, utf8 => 1, canonical => 1 });

To guarantee utf8=1, canonical=1. Theoretically %data could contain the
keys (utf8=0, canonical=0) overriding your manually set values, due to
perls hash expansion. Re-ordering should guarantee consistency.

>  
>  sub fromjs($) {
> @@ -155,7 +155,7 @@ sub save {
>      }
>      # pretty => 1 for readability
>      # canonical => 1 to reduce churn
> -    file_set_contents($self->{path}, tojs($o, pretty => 1, canonical => 1));
> +    file_set_contents($self->{path}, tojs($o, pretty => 1));
>  }
>  
>  # Load serialized account JSON file into $self
> @@ -196,7 +196,7 @@ sub jwk {
>  sub jwk_thumbprint {
>      my ($self) = @_;
>      my $jwk = $self->jwk(1); # $pure = 1
> -    return encode(sha256(tojs($jwk, canonical => 1))); # canonical sorts
> +    return encode(sha256(tojs($jwk)));
>  }
>  
>  # A key authorization string in acme is a challenge token dot-connected with