HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

Summary

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Remediation

1. Inventory every Eclipse Foundation Eclipse KeyPont - GOSE deployment, including staging.
2. Upgrade Eclipse Foundation Eclipse KeyPont - GOSE to 1.0.0-rc1.
3. Confirm the running version after the upgrade.

References

• Referencehttps://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m