Payload gets mangled by JWS signing with multiple recipients + unencoded payload

[nhartner]

Describe the bug

Using unencoded option (RFC7797) with multiple signatures/recipients causes the payload to the signed JWS to get garbled.

To Reproduce

Following code will reproduce the issue:

jose = require('jose')

var key1 = jose.JWK.generateSync('EC')
var key2 = jose.JWK.generateSync('EC')

var payload = 'test'
var signer = new jose.JWS.Sign(payload)
signer.recipient(key1, { b64: false, crit: ['b64'] }, {})
signer.recipient(key2, { b64: false, crit: ['b64'] }, {})
signer.sign('general')

The result is:

{
  payload: '��-',
  signatures: [
    {
      protected: 'eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCJdLCJhbGciOiJFUzI1NiJ9',
      header: {},
      signature: 'O63LN2RxA2aa3QoCAR2PmfJDciDGrzlJYOWF-d1JDiczHHWG_VdMZvNfof6QWvK3H3q-0LsfuCacdZng6ELLPA'
    },
    {
      protected: 'eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCJdLCJhbGciOiJFUzI1NiJ9',
      header: {},
      signature: 'fKWZYFlY0HWRrF1mb3TacaLMK_awINlVWriZkwK6Re7HxtznJu6jOL99mE4oA11U8w1k3p8-L9iUBsGZiRuxrA'
    }
  ]
}

Note: the weird characters in the payload. Should just be test.

Expected behaviour

The result should look like this:

{
  payload: 'test',
  signatures: [
    {
      protected: 'eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCJdLCJhbGciOiJFUzI1NiJ9',
      header: {},
      signature: 'O63LN2RxA2aa3QoCAR2PmfJDciDGrzlJYOWF-d1JDiczHHWG_VdMZvNfof6QWvK3H3q-0LsfuCacdZng6ELLPA'
    },
    {
      protected: 'eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCJdLCJhbGciOiJFUzI1NiJ9',
      header: {},
      signature: 'fKWZYFlY0HWRrF1mb3TacaLMK_awINlVWriZkwK6Re7HxtznJu6jOL99mE4oA11U8w1k3p8-L9iUBsGZiRuxrA'
    }
  ]
}

Environment:

• jose version: [e.g. v1.27.2]
• node version: [e.g. v14.5.0]

Additional context
Add any other context about the problem here.

The above code works as expected if only one recipient is added before signing.

• [X ] the bug is happening on latest jose too.
• i have searched the issues tracker on github for similar issues and couldn't find anything related.

[panva]

Thanks for bringing this up.

[panva]

Fixed in v1.27.3.