Add RFC 9421 support via rfc-http-sig capability and publicKeys array #305
Conversation
mickenordin
commented
Dec 3, 2025
mickenordin
commented
- Add rfc-http-sig capability to advertise RFC 9421 support
- Add publicKeys array with algorithm field for HTTP Message Signatures
- Deprecate publicKey field in favor of publicKeys
- Reference IANA HTTP Signature Algorithms Registry
- Maintain backward compatibility with draft-cavage signatures used by Nextcloud
glpatcern
left a comment
glpatcern
left a comment
There was a problem hiding this comment.
Some minor changes to fit in the width and to just refer to http-sig as capability.
| DEPRECATED: Use publicKeys array instead for RFC 9421 support. | ||
| Legacy field for draft-cavage HTTP Signatures (RSA only). | ||
| Maintained for backward compatibility with existing deployments. | ||
| The signatory is optional but it MUST contain `keyId` and `publicKeyPem`. |
There was a problem hiding this comment.
As commented in person, I'm tempted to say we entirely drop this as opposed to deprecate it, despite we know there is one implementation. I'd like to see what other people think about this.
There was a problem hiding this comment.
I also agree that we should drop it, true that Nextcloud is still using this but in case of an update, they can still backport it.
There was a problem hiding this comment.
Since we change the key, and allow arbitrary fields it will not impact Nextcloud if we remove it, but we have a lot of other deprecated things in there already and it is good practice to deprecate before removing I think. But not a strong opinion, I am fine with just removing it if that is what people want
glpatcern
left a comment
glpatcern
left a comment
There was a problem hiding this comment.
So it seems there's no strong opinion either way. Maybe let's bring the topic of deprecation to the mailing list? Otherwise this looks good for me
* Add http-sig capability to advertise RFC 9421 support * Add publicKeys array with algorithm field for HTTP Message Signatures * Deprecate publicKey field in favor of publicKeys * Reference IANA HTTP Signature Algorithms Registry Co-authored-by: Giuseppe Lo Presti <[email protected]>
mickenordin
force-pushed
the
kano-http-sig
branch
from
cdda178 to
72af0ef
Compare
