Merge pull request #4 from jbowes/fix-digest-verify

Fix digest verification

Author: jbowes

digest.go

@@ -26,5 +26,5 @@ func verifyDigest(in []byte, dig string) bool {
 	// TODO: case insensitity for incoming digest?
 	calc := calcDigest(in)
 
-	return subtle.ConstantTimeCompare([]byte(dig), []byte(calc)) == 0
+	return subtle.ConstantTimeCompare([]byte(dig), []byte(calc)) == 1
 }

httpsig.go

@@ -76,7 +76,7 @@ func NewSignTransport(transport http.RoundTripper, opts ...signOption) http.Roun
 
 		// Always set a digest (for now)
 		// TODO: we could skip setting digest on an empty body if content-length is included in the sig
-		r.Header.Set("Digest", calcDigest(b.Bytes()))
+		nr.Header.Set("Digest", calcDigest(b.Bytes()))
 
 		msg := messageFromRequest(nr)
 		hdr, err := s.Sign(msg)