mmo-ref/dep-curl
1
0
Fork 0
mirror of https://github.com/curl/curl synced 2026-08-25 12:32:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

httpsig: add RFC 9421 HTTP Message Signatures support

Browse source 
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.

New libcurl options:
 - CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
 - CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
 - CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
 - CURLOPT_HTTPSIG_HEADERS: space-separated components to sign

New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers

The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.

Verified by test 5000 to 5021

Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
This commit is contained in:
Sameeh Jubran 2026-07-24 22:49:52 +02:00 • committed by Daniel Stenberg
parent ebc5212dac
commit a55731050e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
78 changed files with 3192 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

3
CMakeLists.txt
View file

@ -435,6 +435,8 @@ option(CURL_DISABLE_NEGOTIATE_AUTH "Disable negotiate authentication" OFF)
mark_as_advanced(CURL_DISABLE_NEGOTIATE_AUTH)
option(CURL_DISABLE_AWS "Disable aws-sigv4" OFF)
mark_as_advanced(CURL_DISABLE_AWS)
option(CURL_DISABLE_HTTPSIG "Disable HTTP Message Signatures (RFC 9421)" ON)
mark_as_advanced(CURL_DISABLE_HTTPSIG)
option(CURL_DISABLE_DICT "Disable DICT" OFF)
mark_as_advanced(CURL_DISABLE_DICT)
option(CURL_DISABLE_DOH "Disable DNS-over-HTTPS" OFF)
@ -2037,6 +2039,7 @@ curl_add_if("SSPI" USE_WINDOWS_SSPI)
curl_add_if("GSS-API" HAVE_GSSAPI)
curl_add_if("alt-svc" NOT CURL_DISABLE_ALTSVC)
curl_add_if("HSTS" NOT CURL_DISABLE_HSTS)
curl_add_if("HTTPSIG" NOT CURL_DISABLE_HTTPSIG)
curl_add_if("SPNEGO" NOT CURL_DISABLE_NEGOTIATE_AUTH AND
(HAVE_GSSAPI OR USE_WINDOWS_SSPI))
curl_add_if("Kerberos" NOT CURL_DISABLE_KERBEROS_AUTH AND