Module rfc9421 

HTTP Message Signatures (RFC 9421).

The successor to the draft-cavage signatures ActivityPub grew up on. Where the draft signs a list of header names against an ad-hoc string, RFC 9421 signs components — including derived ones like @method and @target-uri — against a canonical signature base, and carries the covered list in its own Signature-Input header so a verifier reconstructs exactly what was signed.

Mastodon 4.7 sends these as a fallback: a request goes out with a cavage signature first, and is retried with an RFC 9421 one if the peer answers 400 or 401. It covers ("@method" "@target-uri" "content-digest") for a request with a body and ("@method" "@target-uri") for one without, which is what sign_request produces.

Structs

SignedHeaders

Headers produced by sign_request, to attach to the outgoing request.

Enums

Algorithm

A signature algorithm this module can produce and check.

SigningKey

The private key a signature is made with.

VerifyingKey

The public key a signature is checked against.

Functions

content_digest

The Content-Digest field value for a body: a structured-field dictionary whose sha-256 member holds the digest as a byte sequence (RFC 9530).

covered_components

The components a Signature-Input claims to cover.

created_at

The created parameter of a Signature-Input, as a Unix timestamp.

expires_at

The expires parameter of a Signature-Input, as a Unix timestamp.

key_id

The keyid parameter of a Signature-Input: the URI identifying the key that signed, which the verifier resolves to a public key.

sign_request

Sign an outgoing request.

sign_response

Sign a response over @status and content-digest, as Linzer signs one (Linzer.sign!(response, key:, components: %w(@status content-digest))) and the Fediverse Auxiliary Service Provider protocol has both sides sign theirs.

verify_request

Verify an RFC 9421 signature on an inbound request.

verify_response

Verify an RFC 9421 signature on a response, given its status, the Signature-Input and Signature field values, and its header fields.