Upgrade interned jwx (0.9.x) with github.com/lestrrat-go/jwx/v3 #7733

lestrrat · 2025-06-27T12:47:23Z

Why the changes in this PR are needed?

What are the changes in this PR?

Replaces the interned github.com/lestrrat-go/jwx (probably v0.9.x!!!) with latest github.com/lestrrat-go/jwx/v3

Notes to assist PR review:

At the time of creation, this PR has these problems, which have been discussed in #7638 already

There exist many errors in tests, but these errors are mismatches in expected error messages.
go mod vendor has been run locally, but as of this PR submission it has not been included in this PR, as it probably clutters up the diff.

Further comments:

Replaced most everything with jws/jwsbb, which is a low-level API that handles signing/verifying
Removed duplicate features from opa code - e.g. jwsbb can do all the verification, so removed verifyECDSA and the like.
Not included in this PR, but I have a feeling signing keys can also be completely handled by jwx, without having to do anything in this library (e.g. PEM decoding)

netlify · 2025-06-27T12:49:27Z

✅ Deploy Preview for openpolicyagent ready!

Name	Link
🔨 Latest commit	`666105c`
🔍 Latest deploy log	https://app.netlify.com/projects/openpolicyagent/deploys/6890aa4ebaf6870008a9619f
😎 Deploy Preview	https://deploy-preview-7733--openpolicyagent.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

johanfylling

This is a great effort, thank you for working on this! 😃

There are a couple of failing yaml tests (TestRego); looks like they're all related to error message mismatches.

johanfylling · 2025-07-03T08:46:44Z

v1/bundle/keys.go

-	block, _ := pem.Decode([]byte(s.Key))
-	if block != nil {
-		return sign.GetSigningKey(s.Key, jwa.SignatureAlgorithm(s.Algorithm))
+	alg, ok := jwa.LookupSignatureAlgorithm(s.Algorithm)


This check looks like it could be less expensive than reading a file from disk, should we move it up top?

v1/bundle/keys.go

v1/bundle/sign.go

v1/bundle/sign_test.go

v1/bundle/verify.go

v1/plugins/rest/auth.go

v1/topdown/tokens.go

johanfylling · 2025-07-03T17:18:32Z

v1/topdown/tokens.go

+		return errors.New("no keys found in JWK set")
 	}
-	if jwk.GetKeyTypeFromKey(key) != keys.Keys[0].GetKeyType() {
-		return errors.New("JWK derived key type and keyType parameter do not match")


This is a funny check, but I assume it's not necessary anymore. Ensured to not happen by jwk.Parse()?

johanfylling · 2025-07-03T17:26:46Z

go.mod

 	github.com/gobwas/glob v0.2.3
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
+	github.com/lestrrat-go/jwx/v3 v3.0.8


I think vendoring won't impede reviewing.

I was also actively updating the code, so... :) I will add the vendored code in my subsequent commits

lestrrat · 2025-07-04T04:01:24Z

I think I fixed most everything? I'm not sure why I'm getting these conflicts as I seem to be up-to-date...

Signed-off-by: Daisuke Maki <[email protected]>

* use jws.Parse to remove duplicate code (jws handles it) * align error messages to new error messages Signed-off-by: Daisuke Maki <[email protected]>

Signed-off-by: Daisuke Maki <[email protected]>

lestrrat · 2025-07-06T21:55:42Z

added the signoffs.

johanfylling · 2025-07-09T08:59:06Z

Thank you @lestrrat! I'll try to review your changes as soon as possible, but might take me until start of next week to clear out my backlog.

johanfylling

Thank you! LGTM 👍

We should remove the draft status from this PR, so CI/CD can run all checks (unless there is some reason not to that I'm unaware of).

There are still some tests that haven't been touched up with the new error messages:

$ make test
...
--- FAIL: TestRego (0.50s)
    --- FAIL: TestRego/v1/jwtencodesignheadererrors/Unknown_signature_algorithm (0.00s)
        exported_test.go:36: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse object: missing ':' after object key; unparsed tail: \"JWT\\\",\\r\\n \\\"alg\\\":\\\"HS256\\\"}\""
    --- FAIL: TestRego/v1/jwtencodesignheadererrors/Empty_headers_input_error (0.00s)
        exported_test.go:36: expected topdown error text "unexpected end of JSON input" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse empty string; unparsed tail: \"\""
    --- FAIL: TestRego/v1/jwtencodesignheadererrors/Empty_JSON_header_Error (0.00s)
        exported_test.go:36: expected topdown error text "unsupported signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
    --- FAIL: TestRego/v1/jwtencodesignheadererrors/No_JSON_Error (0.00s)
        exported_test.go:36: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
    --- FAIL: TestRego/v1/jwtencodesignheadererrors/unknown_signature_algorithm (0.00s)
        exported_test.go:36: expected topdown error text "unknown signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: dummy"
    --- FAIL: TestRego/v0/jwtencodesignheadererrors/unknown_signature_algorithm (0.00s)
        exported_test.go:29: expected topdown error text "unknown signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: dummy"
    --- FAIL: TestRego/v0/jwtencodesignheadererrors/Unknown_signature_algorithm (0.00s)
        exported_test.go:29: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse object: missing ':' after object key; unparsed tail: \"JWT\\\",\\r\\n \\\"alg\\\":\\\"HS256\\\"}\""
    --- FAIL: TestRego/v0/jwtencodesignheadererrors/No_JSON_Error (0.00s)
        exported_test.go:29: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
    --- FAIL: TestRego/v0/jwtencodesignheadererrors/Empty_headers_input_error (0.00s)
        exported_test.go:29: expected topdown error text "unexpected end of JSON input" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse empty string; unparsed tail: \"\""
    --- FAIL: TestRego/v0/jwtencodesignheadererrors/Empty_JSON_header_Error (0.00s)
        exported_test.go:29: expected topdown error text "unsupported signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
--- FAIL: TestRegoWithNDBCache (0.50s)
    --- FAIL: TestRegoWithNDBCache/v1/jwtencodesignheadererrors/unknown_signature_algorithm (0.00s)
        exported_test.go:69: expected topdown error text "unknown signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: dummy"
    --- FAIL: TestRegoWithNDBCache/v1/jwtencodesignheadererrors/Unknown_signature_algorithm (0.00s)
        exported_test.go:69: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse object: missing ':' after object key; unparsed tail: \"JWT\\\",\\r\\n \\\"alg\\\":\\\"HS256\\\"}\""
    --- FAIL: TestRegoWithNDBCache/v1/jwtencodesignheadererrors/No_JSON_Error (0.00s)
        exported_test.go:69: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
    --- FAIL: TestRegoWithNDBCache/v1/jwtencodesignheadererrors/Empty_headers_input_error (0.00s)
        exported_test.go:69: expected topdown error text "unexpected end of JSON input" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse empty string; unparsed tail: \"\""
    --- FAIL: TestRegoWithNDBCache/v1/jwtencodesignheadererrors/Empty_JSON_header_Error (0.00s)
        exported_test.go:69: expected topdown error text "unsupported signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
    --- FAIL: TestRegoWithNDBCache/v0/jwtencodesignheadererrors/unknown_signature_algorithm (0.00s)
        exported_test.go:60: expected topdown error text "unknown signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: dummy"
    --- FAIL: TestRegoWithNDBCache/v0/jwtencodesignheadererrors/Unknown_signature_algorithm (0.00s)
        exported_test.go:60: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse object: missing ':' after object key; unparsed tail: \"JWT\\\",\\r\\n \\\"alg\\\":\\\"HS256\\\"}\""
    --- FAIL: TestRegoWithNDBCache/v0/jwtencodesignheadererrors/No_JSON_Error (0.00s)
        exported_test.go:60: expected topdown error text "invalid character" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
    --- FAIL: TestRegoWithNDBCache/v0/jwtencodesignheadererrors/Empty_headers_input_error (0.00s)
        exported_test.go:60: expected topdown error text "unexpected end of JSON input" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: missing or invalid 'alg' header: cannot parse JSON: cannot parse empty string; unparsed tail: \"\""
    --- FAIL: TestRegoWithNDBCache/v0/jwtencodesignheadererrors/Empty_JSON_header_Error (0.00s)
        exported_test.go:60: expected topdown error text "unsupported signature algorithm" but got: "test-0.rego:4: eval_builtin_error: io.jwt.encode_sign_raw: unknown JWS algorithm: "
FAIL

These are the files with failing tests:

v0/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0379.yaml
v0/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0380.yaml
v0/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0381.yaml
v0/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0382.yaml
v0/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0383.yaml
v1/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0379.yaml
v1/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0380.yaml
v1/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0381.yaml
v1/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0382.yaml
v1/test/cases/testdata/v1/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0383.yaml

And we should sync with main.

If you give me push access to your branch, I can help you wrap these things.

johanfylling · 2025-07-28T13:43:37Z

v1/bundle/verify.go

+	//
+	// (lestrrat) Whoa, you're going to trust the payload before you
+	// verify the signature? Even if it's for backwrds compatibility,
+	// Is this OK?


It's not ideal, but given that the key must still exist outside the JWT, and the signature encompasses both the header and payload, this wouldn't impact the security concerns, right?
Unless I'm completely mistaken, if it wasn't for the key-id and algorithm meta being required as cleartext for encrypted tokens, the header doesn't add cryptographic value; it's more for separating meta about the token from its claims(?).

I agree that it's not an everyday situation, but the attacker would be able to choose which key the data is to be verified with. So if hypothetically a particular key has already been compromised/leaked, it would be very easy for an attacker to forge a JWS with the leaked key, and force you to verify its authenticity with said key. Yes, I agree that all bets are already off when the key is leaked, but this would just be another opening that they could exploit further.

From my standpoint I'd have to say to stick with "don't ever trust the payload until it's properly verified".

the attacker would be able to choose which key the data is to be verified with.

Isn't that also the case for when the key-ID is in the header, given that the token has been created by the attacker wholesale?

I suppose in 99% of the cases what you just described is true; I admit I'm only the implementer and not the designer of the protocol, and thus my knowledge there is weak sauce and I'm willing to concede that I don't entirely know what I'm talking about. But I do, however, as someone who is at least partially responsible for other people's security, believe that I shouldn't just say it's okay to break protocol rules because something bigger is broken -- I believe every small bit counts.

Either way, I don't think it needs to be changed right now, as I'm sure there could be plenty of code out there which already relies on this behavior, so it's just my $.02. When/if the time comes for a major upgrade, I hope this is at least looked at with a fresh set of eyes :)

Thank you for your input on this @lestrrat. I agree with you that it's often better to follow protocol, and not do anything special, as it can open up unforeseen attack vectors 👍. I'm not familiar with the background of this fallback behavior, nor how many users we have out there that rely on it, but we might be able to drop it in the future - or make it an opt-in through configuration.

v1/topdown/tokens.go

lestrrat · 2025-07-31T05:32:40Z

@johanfylling apologies, I did notice activity, but I didn't immediately notice this was addressed to me. You should have received an invitation to my repository

johanfylling · 2025-08-01T08:26:43Z

@lestrrat, you shouldn't need to give me full access to your repo, it should be possible to only give push access to the origin branch for this PR.

johanfylling

Thank you for the great work! 😃

Would you mind amending your last commit to add a sign-off, to make the DCO check happy?

Signed-off-by: Daisuke Maki <[email protected]>

lestrrat · 2025-08-01T11:16:33Z

@johanfylling DCO problem fixed!

Signed-off-by: Johan Fylling <[email protected]>

Conflicts: go.mod go.sum vendor/golang.org/x/sys/cpu/cpu_other_ppc64x.go vendor/golang.org/x/sys/cpu/cpu_other_riscv64.go vendor/golang.org/x/sys/cpu/cpu_other_x86.go vendor/modules.txt

Signed-off-by: Johan Fylling <[email protected]>

johanfylling

@lestrrat, I've pushed a couple of commits to your branch to make it ready to merge.
While doing so, I encountered a minor usability issue in the API. Not a blocker, but if it was possible to easily differentiate between when a header attribute is missing and when the header is broken/invalid, it'd great.

johanfylling · 2025-08-04T09:46:43Z

v1/bundle/verify.go

+		// use to determine the key to use for verification.
+		hdr := jwsbb.HeaderParseCompact(hdrb64)
+		v, err := jwsbb.HeaderGetString(hdr, "kid")
+		if err != nil && err.Error() != `jwsbb: header "kid" not found` {


@lestrrat, here it'd be very useful if the headerNotFoundError error type was public, so we can do a type check instead of a string comparison. Alternatively, a helper function that does the type check, if there are reasons for keeping the type private.
Would it be possible to make this update?

Ah, my bad. I named the struct headerNotFound, but I made the public accessor to this error FieldNotFound, and ended up not testing against errors.Is. What a f'up. Fix coming...

I tested this locally, but can you check on your side if this fixes it for you:

Please get jwx @ lestrrat-go/jwx@c14c1d5

Please apply the following diff to v1/bundle/verify.go

I'd appreciate it if you could verify that it works on your side before I make another release in haste :)

diff --git a/v1/bundle/verify.go b/v1/bundle/verify.go index 8dfc18a38..2302a2ae3 100644 --- a/v1/bundle/verify.go +++ b/v1/bundle/verify.go @@ -130,12 +130,16 @@ func verifyJWTSignature(token string, bvc *VerificationConfig) (*DecodedSignatur // use to determine the key to use for verification. hdr := jwsbb.HeaderParseCompact(hdrb64) v, err := jwsbb.HeaderGetString(hdr, "kid") - if err != nil && err.Error() != `jwsbb: header "kid" not found` { + switch { + case err == nil: + // err == nils means we found the key ID in the header + keyID = v + case errors.Is(err, jwsbb.ErrHeaderNotFound()): + // no "kid" in the header. no op. + default: + // some other error occurred while trying to extract the key ID return nil, fmt.Errorf("failed to extract key ID from headers: %w", err) } - // if kid is not present in the header, it will still return the empty - // string, so it would be the same as if we had not set it at all. - keyID = v } // Because we want to fallback to ds.KeyID when we can't find the

This works splendidly on my end 👍

Thanks! release and a commit coming up in a bit...

@johanfylling done 666105c

This release fixes the problem with undetectable HeaderNotFound error Signed-off-by: Daisuke Maki <[email protected]>

anderseknert · 2025-08-04T17:31:47Z

What a terrific contribution! Thank you, @lestrrat 👏

lestrrat · 2025-08-04T22:00:38Z

Thanks @anderseknert and @johanfylling !

lestrrat changed the title ~~Jwx3~~ Upgrade interned jwx (0.9.x) with github.com/lestrrat-go/jwx/v3 Jun 27, 2025

johanfylling reviewed Jul 3, 2025

View reviewed changes

lestrrat added 25 commits July 7, 2025 06:54

First pass replacing internal/jwx with jwx v3

8eccf4b

Signed-off-by: Daisuke Maki <[email protected]>

Result after running go mod vendor

0cd5fa7

Signed-off-by: Daisuke Maki <[email protected]>

Just use jwa.LookupSignatureAlgorithm

1440bc9

Signed-off-by: Daisuke Maki <[email protected]>

Fix verify/verify_test

efdceb6

* use jws.Parse to remove duplicate code (jws handles it) * align error messages to new error messages Signed-off-by: Daisuke Maki <[email protected]>

Use the jws/jwsbb functions

f6931e1

Signed-off-by: Daisuke Maki <[email protected]>

Update signing

d1a6574

Signed-off-by: Daisuke Maki <[email protected]>

remove panic introduced for debugging

d1e90ac

Signed-off-by: Daisuke Maki <[email protected]>

Add t.Helper to better report where the failure is

14a6469

Signed-off-by: Daisuke Maki <[email protected]>

Add t.Helper to better report where the failure is

917c244

Signed-off-by: Daisuke Maki <[email protected]>

Fix v1/topdown with latest jwsbb

12a6727

Signed-off-by: Daisuke Maki <[email protected]>

Let jwsbb do all the verification

3394b22

Signed-off-by: Daisuke Maki <[email protected]>

Check error return

4e32199

Signed-off-by: Daisuke Maki <[email protected]>

use any

a5768f0

Signed-off-by: Daisuke Maki <[email protected]>

me being silly

21fd957

Signed-off-by: Daisuke Maki <[email protected]>

Update error message

2d71b51

Signed-off-by: Daisuke Maki <[email protected]>

Check for errors

1ffce27

Signed-off-by: Daisuke Maki <[email protected]>

wrap error

da78fcc

Signed-off-by: Daisuke Maki <[email protected]>

Change expected error message

40ba370

Signed-off-by: Daisuke Maki <[email protected]>

Fix error messages

8b09089

Signed-off-by: Daisuke Maki <[email protected]>

Assert len(signature) == 1

23dd6bf

Signed-off-by: Daisuke Maki <[email protected]>

Run go mod vendor

c129930

Signed-off-by: Daisuke Maki <[email protected]>

This should be PRIVATE KEY

cffd719

Signed-off-by: Daisuke Maki <[email protected]>

tweak

e10076f

Signed-off-by: Daisuke Maki <[email protected]>

align mapstructure version

3275d4d

Signed-off-by: Daisuke Maki <[email protected]>

check for algorithm before reading file

37c4381

Signed-off-by: Daisuke Maki <[email protected]>

johanfylling reviewed Jul 28, 2025

View reviewed changes

lestrrat marked this pull request as ready for review July 31, 2025 07:03

johanfylling approved these changes Aug 1, 2025

View reviewed changes

Update jwx to v3.0.9

de56ec6

Signed-off-by: Daisuke Maki <[email protected]>

johanfylling added 4 commits August 4, 2025 11:00

Vendoring

77aee7f

Signed-off-by: Johan Fylling <[email protected]>

Fixing tests

30ddb69

Signed-off-by: Johan Fylling <[email protected]>

Merge branch 'main' into jwx3

042d5e1

Conflicts: go.mod go.sum vendor/golang.org/x/sys/cpu/cpu_other_ppc64x.go vendor/golang.org/x/sys/cpu/cpu_other_riscv64.go vendor/golang.org/x/sys/cpu/cpu_other_x86.go vendor/modules.txt

Fixing linter issues

8429646

Signed-off-by: Johan Fylling <[email protected]>

johanfylling reviewed Aug 4, 2025

View reviewed changes

Update jwx to v3.0.10

666105c

This release fixes the problem with undetectable HeaderNotFound error Signed-off-by: Daisuke Maki <[email protected]>

johanfylling merged commit b08a1df into open-policy-agent:main Aug 4, 2025
31 checks passed

lestrrat mentioned this pull request Aug 4, 2025

feat: add support for EdDSA (ed25519) keys both in jwks and jwt sign/verify #7613

Closed

Upgrade interned jwx (0.9.x) with github.com/lestrrat-go/jwx/v3 #7733

Upgrade interned jwx (0.9.x) with github.com/lestrrat-go/jwx/v3 #7733

Uh oh!

Conversation

lestrrat commented Jun 27, 2025

Why the changes in this PR are needed?

What are the changes in this PR?

Notes to assist PR review:

Further comments:

Uh oh!

netlify bot commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for openpolicyagent ready!

Uh oh!

johanfylling left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lestrrat commented Jul 4, 2025

Uh oh!

lestrrat commented Jul 6, 2025

Uh oh!

johanfylling commented Jul 9, 2025

Uh oh!

johanfylling left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lestrrat Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lestrrat commented Jul 31, 2025

Uh oh!

johanfylling commented Aug 1, 2025

Uh oh!

johanfylling left a comment

Choose a reason for hiding this comment

Uh oh!

lestrrat commented Aug 1, 2025

Uh oh!

johanfylling left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

anderseknert commented Aug 4, 2025

netlify bot commented Jun 27, 2025 •

edited

Loading

lestrrat Jul 31, 2025 •

edited

Loading