internal/

Package assurance applies ssf.AssuranceProduction's requirements, the same for every role.

Package clientassertion builds the signed JWTs a client presents to an OAuth 2.0 token endpoint instead of a client secret (RFC 7523 §2.2, OpenID Connect Core §9: client_secret_jwt and private_key_jwt).

Package critical implements the "crit" (Critical) Header Parameter check RFC 7515 §4.1.11 (JWS) and RFC 7516 §4.1.13 (JWE, which inherits the JWS rule) both require: a header must be rejected only if "crit" names a parameter the recipient doesn't actually understand and process — every other unrecognized member is ignored, never rejected (RFC 7515 §4.2/§4.3, RFC 7516 §4.2/§4.3).

Command doccheck builds the Go code in the documentation, so it cannot drift from the API it describes.

Command doclint reports exported identifiers of the public packages that have no doc comment: declarations, and the fields of exported structs (design rule 14).

Package jose implements the JWS and JWK primitives SSFgo needs to sign and verify Security Event Tokens: compact serialization; RSASSA-PKCS1-v1_5 and RSASSA-PSS with SHA-256, -384 and -512, ECDSA on P-256, P-384 and P-521, and EdDSA with Ed25519 — every asymmetric algorithm of RFC 7518 §3.1, and RFC 8037's; and public JWK / JWK Set parsing.

Package jsonobj decodes a JSON object strictly: a member named twice is an error, not a value the last occurrence silently wins.

Package peertext makes text from the other party — a Transmitter's error body, a Receiver's rejection, a header member of a SET anyone could push — safe to log, return or report to a hook: cut to a bound the caller names, with anything but printable ASCII replaced, so it can neither flood a log nor forge or disguise a line of one.

Package setcodec signs and verifies Security Event Tokens as profiled by SSF 1.0 §4.

Package testcert makes throwaway TLS certificates for SSFgo's conformance harnesses.