[PATCH proxmox-acme 0/1] fix #7749: always serialize in same order

[PATCH proxmox-acme 0/1] fix #7749: always serialize in same order

[Thomas Ellmenreich]

Serializing acme responses to json, because of perls randomized hash key order,
would lead to unequal serialized responses if they were compared as bytes. By
setting "canonical => 1" the serializations now always have the same order and
can thus be compared bytewise.

I have tested the patch against a local instance of HashiCorp Vault PKI and the
EAB registration works.

It seems that "canonical" can have performance implications when serialising
larger objects, but since the objects produced in our acme client are
relatively small, I consider this acceptable.


proxmox-acme:

Thomas Ellmenreich (1):
  fix #7749: always serialize in same order

 src/PVE/ACME.pm | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)


Summary over all repositories:
  1 files changed, 4 insertions(+), 4 deletions(-)

-- 
Generated by murpp 0.12.0

[PATCH proxmox-acme 1/1] fix #7749: always serialize in same order

[Thomas Ellmenreich]

All objects are now serialized with "canonical => 1" so that the
resulting bytes are directly comparable. Perls randomized hash key
orders lead to different serialization outputs even with the same input.

Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 src/PVE/ACME.pm | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e6fb9c2..a5287ac 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -64,9 +64,9 @@ sub encode($) { # acme requires 'base64url' encoding
     return encode_base64url($_[0]);
 }
 
-sub tojs($;%) { # shortcut for to_json with utf8=>1
+sub tojs($;%) { # shortcut for to_json with utf8=>1 and canonical=>1
     my ($data, %data) = @_;
-    return to_json($data, { utf8 => 1, %data });
+    return to_json($data, { utf8 => 1, canonical => 1, %data });
 }
 
 sub fromjs($) {
@@ -155,7 +155,7 @@ sub save {
     }
     # pretty => 1 for readability
     # canonical => 1 to reduce churn
-    file_set_contents($self->{path}, tojs($o, pretty => 1, canonical => 1));
+    file_set_contents($self->{path}, tojs($o, pretty => 1));
 }
 
 # Load serialized account JSON file into $self
@@ -196,7 +196,7 @@ sub jwk {
 sub jwk_thumbprint {
     my ($self) = @_;
     my $jwk = $self->jwk(1); # $pure = 1
-    return encode(sha256(tojs($jwk, canonical => 1))); # canonical sorts
+    return encode(sha256(tojs($jwk)));
 }
 
 # A key authorization string in acme is a challenge token dot-connected with
-- 
2.47.3

Re: [PATCH proxmox-acme 1/1] fix #7749: always serialize in same order

[Elias Huhsovitz]

Small nit below, otherwise

Reviewed-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>

On Tue Jul 14, 2026 at 11:04 AM CEST, Thomas Ellmenreich wrote:
> All objects are now serialized with "canonical => 1" so that the
> resulting bytes are directly comparable. Perls randomized hash key
> orders lead to different serialization outputs even with the same input.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
>  src/PVE/ACME.pm | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..a5287ac 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -64,9 +64,9 @@ sub encode($) { # acme requires 'base64url' encoding
>      return encode_base64url($_[0]);
>  }
>  
> -sub tojs($;%) { # shortcut for to_json with utf8=>1
> +sub tojs($;%) { # shortcut for to_json with utf8=>1 and canonical=>1
>      my ($data, %data) = @_;
> -    return to_json($data, { utf8 => 1, %data });
> +    return to_json($data, { utf8 => 1, canonical => 1, %data });
>  }

nit: change the ordering to:

return to_json($data, { %data, utf8 => 1, canonical => 1 });

To guarantee utf8=1, canonical=1. Theoretically %data could contain the
keys (utf8=0, canonical=0) overriding your manually set values, due to
perls hash expansion. Re-ordering should guarantee consistency.

>  
>  sub fromjs($) {
> @@ -155,7 +155,7 @@ sub save {
>      }
>      # pretty => 1 for readability
>      # canonical => 1 to reduce churn
> -    file_set_contents($self->{path}, tojs($o, pretty => 1, canonical => 1));
> +    file_set_contents($self->{path}, tojs($o, pretty => 1));
>  }
>  
>  # Load serialized account JSON file into $self
> @@ -196,7 +196,7 @@ sub jwk {
>  sub jwk_thumbprint {
>      my ($self) = @_;
>      my $jwk = $self->jwk(1); # $pure = 1
> -    return encode(sha256(tojs($jwk, canonical => 1))); # canonical sorts
> +    return encode(sha256(tojs($jwk)));
>  }
>  
>  # A key authorization string in acme is a challenge token dot-connected with