Deprecate Android SafetyNet support

phpstan-baseline.neon

@@ -860,6 +860,14 @@ parameters:
 			count: 4
 			path: src/symfony/src/DependencyInjection/Configuration.php
 
+		-
+			message: """
+				#^Call to deprecated method addAndroidSafetynetConfig\\(\\) of class Webauthn\\\\Bundle\\\\DependencyInjection\\\\Configuration\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/DependencyInjection/Configuration.php
+
 		-
 			message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeParentInterface\\:\\:scalarNode\\(\\)\\.$#"
 			count: 1
@@ -1030,6 +1038,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/DependencyInjection/Factory/Security/WebauthnFactory.php
 
+		-
+			message: """
+				#^Call to deprecated method loadAndroidSafetyNet\\(\\) of class Webauthn\\\\Bundle\\\\DependencyInjection\\\\WebauthnExtension\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/DependencyInjection/WebauthnExtension.php
+
 		-
 			message: "#^Cannot access offset 'failure_handler' on mixed\\.$#"
 			count: 4
@@ -1241,6 +1257,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/Repository/PublicKeyCredentialSourceRepository.php
 
+		-
+			message: """
+				#^Fetching class constant class of deprecated class Webauthn\\\\AttestationStatement\\\\AndroidSafetyNetAttestationStatementSupport\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/Resources/config/android_safetynet.php
+
 		-
 			message: """
 				#^Fetching class constant class of deprecated class Webauthn\\\\PublicKeyCredentialLoader\\:
@@ -1768,6 +1792,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/Service/PublicKeyCredentialRequestOptionsFactory.php
 
+		-
+			message: """
+				#^Instantiation of deprecated class Webauthn\\\\Bundle\\\\DependencyInjection\\\\Compiler\\\\EnforcedSafetyNetApiKeyVerificationCompilerPass\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/WebauthnBundle.php
+
 		-
 			message: "#^Method Webauthn\\\\Bundle\\\\WebauthnBundle\\:\\:getContainerExtension\\(\\) never returns null so it can be removed from the return type\\.$#"
 			count: 1

src/symfony/src/DependencyInjection/Compiler/EnforcedSafetyNetApiKeyVerificationCompilerPass.php

@@ -9,6 +9,9 @@
 use Symfony\Component\DependencyInjection\Reference;
 use Webauthn\AttestationStatement\AndroidSafetyNetAttestationStatementSupport;
 
+/**
+ * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+ */
 final class EnforcedSafetyNetApiKeyVerificationCompilerPass implements CompilerPassInterface
 {
     public function process(ContainerBuilder $container): void

src/symfony/src/DependencyInjection/Configuration.php

@@ -456,10 +456,14 @@ private function addMetadataConfig(ArrayNodeDefinition $rootNode): void
             ->end();
     }
 
+    /**
+     * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+     */
     private function addAndroidSafetynetConfig(ArrayNodeDefinition $rootNode): void
     {
         $rootNode->children()
             ->arrayNode('android_safetynet')
+                ->setDeprecated('web-auth/webauthn-symfony-bundle', '4.9.0', 'Android SafetyNet is now deprecated.')
                 ->addDefaultsIfNotSet()
                 ->info('Additional configuration options for the Android SafetyNet attestation.')
                 ->children()

src/symfony/src/DependencyInjection/WebauthnExtension.php

@@ -357,6 +357,7 @@ private function loadRequestControllersSupport(ContainerBuilder $container, arra
     }
 
     /**
+     * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
      * @param mixed[] $config
      */
     private function loadAndroidSafetyNet(ContainerBuilder $container, FileLoader $loader, array $config): void

src/symfony/src/Resources/config/android_safetynet.php

@@ -10,6 +10,7 @@
 use function Symfony\Component\DependencyInjection\Loader\Configurator\param;
 use function Symfony\Component\DependencyInjection\Loader\Configurator\service;
 
+//TODO >=5.0.0: Remove this file
 return static function (ContainerConfigurator $container): void {
     $container = $container->services()
         ->defaults()
@@ -19,6 +20,11 @@
     if (class_exists(JWKFactory::class) && class_exists(RS256::class)) {
         $container
             ->set(AndroidSafetyNetAttestationStatementSupport::class)
+            ->deprecate(
+                'web-auth/webauthn-symfony-bundle',
+                '4.9.0',
+                'The "%service_id%" service is deprecated and will be removed in version 5.0.0. Android SafetyNet is now deprecated.'
+            )
             ->args([service(ClockInterface::class)->nullOnInvalid()])
             ->call('setMaxAge', [param('webauthn.android_safetynet.max_age')])
             ->call('setLeeway', [param('webauthn.android_safetynet.leeway')]);

src/webauthn/composer.json

@@ -51,7 +51,6 @@
         "symfony/property-info": "As of 4.5.x, the symfony/serializer component will become mandatory for converting objects such as the Metadata Statement",
         "phpdocumentor/reflection-docblock": "As of 4.5.x, the phpdocumentor/reflection-docblock component will become mandatory for converting objects such as the Metadata Statement",
         "psr/log-implementation": "Recommended to receive logs from the library",
-        "web-token/jwt-library": "Mandatory for the AndroidSafetyNet Attestation Statement support",
         "symfony/event-dispatcher": "Recommended to use dispatched events"
     }
 }

src/webauthn/src/AttestationStatement/AndroidSafetyNetAttestationStatementSupport.php

@@ -43,6 +43,9 @@
 use function is_string;
 use const JSON_THROW_ON_ERROR;
 
+/**
+ * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+ */
 final class AndroidSafetyNetAttestationStatementSupport implements AttestationStatementSupport, CanDispatchEvents
 {
     private ?string $apiKey = null;