From fcb377212e61ef5ed82e9c9a7c3471b08a8b9056 Mon Sep 17 00:00:00 2001 From: Johan Fylling Date: Sat, 21 Feb 2026 15:24:11 +0100 Subject: [PATCH] chore: Remove unnecessary comment from bundle JWT verification impl (#8354) The concern expressed in this comment has been determined to be unwarranted, so removing it to not cause future confusion. Signed-off-by: Johan Fylling --- v1/bundle/verify.go | 4 ---- 1 file changed, 4 deletions(-) diff --git a/v1/bundle/verify.go b/v1/bundle/verify.go index 82e308b49e..42c8908f73 100644 --- a/v1/bundle/verify.go +++ b/v1/bundle/verify.go @@ -144,10 +144,6 @@ func verifyJWTSignature(token string, bvc *VerificationConfig) (*DecodedSignatur // Because we want to fallback to ds.KeyID when we can't find the // keyID, we need to parse the payload here already. - // - // (lestrrat) Whoa, you're going to trust the payload before you - // verify the signature? Even if it's for backwrds compatibility, - // Is this OK? decoder := base64.RawURLEncoding payload := make([]byte, decoder.DecodedLen(len(payloadb64))) if _, err := decoder.Decode(payload, payloadb64); err != nil {