linzer 0.8.0.beta2 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a917fda2b4d4646e642ba3a52d11bd41a500b5bfed044142a6e0434e0ef1c94
-  data.tar.gz: 8d9296ba21595cba696532a41b20f123569d3b31de0730ba6e7e6f693e87e009
+  metadata.gz: 47932906cedb5dd66d7d2bbc5e8eaac9f01b4e17dd7089bc87b4a06b9505b366
+  data.tar.gz: abe9bf21ac6d66a08f229de3fb10e77bc911c112f812cd0cf620d9f3947d580e
 SHA512:
-  metadata.gz: 2f6b61e4a340594891976d77b651527b8e0d49ff9ab11d73c56f01b5baecc1ad3fdf8ad23d987652496929ef30495cb116ba04a53f1b7ef2d881e8c1c1cfa1c9
-  data.tar.gz: fb4800f527d14823e9ed76b776056fe20a60f35fc3e08c30ce15c05758648476f8489c2d8bb89851fe2c77eeff56891b96ec955663bf08b7b6326cdf4425c881
+  metadata.gz: b4352492dedad2bd9881b9bc6ac5888cdf7855a798f2b650040a9a64c4f7ea81c34178a4bfadb77f5953d82498f1eea69c90529d8b3888d9d182d3896e8415ed
+  data.tar.gz: b2540b62b29a07666c66969f5d6843f674994747fe80e47e71c0ba7f03ad554ccfbd1fcfefca796b7115f6fa2643f2b57b4d058de755c499a87ac87f883a4282

data/CHANGELOG.md

@@ -1,5 +1,42 @@
 ## [Unreleased]
 
+## [0.8.0] - 2026-08-08
+
+(Only one change since the last beta: the Faraday bug fix below. Everything
+else shipped in earlier 0.8.0 betas.)
+
+- Optimize signature parsing, serialization, and validation performance
+  across signing and verifying flows, improving `sign!` throughput by
+  473% and `verify!` by 136% by minimizing Starry usage in hot paths
+  where possible.
+
+- Add comprehensive benchmarking and profiling infrastructure across all
+  supported algorithms.
+
+- Make Rack an optional dependency.
+
+- Add Web Bot Auth support, implementing the current IETF draft
+  (draft-meunier-web-bot-auth-architecture-05).
+  Includes recommended signature parameter defaults, nonce generation,
+  and optional Signature-Agent header handling.
+
+- Fix Faraday adapter deriving URI components from a re-encoded query
+  string, which could differ from the URI faraday actually sent and fail
+  verification at the origin. Affected `@target-uri`, `@request-target`
+  and `@query`. The query is now encoded with the request's own
+  `params_encoder`, so it tracks the URL faraday puts on the wire:
+
+  - Spaces no longer always encode as `+`. Faraday honours the
+    process-wide `Faraday::Utils.default_space_encoding`, which other
+    gems may set (the `oauth2` gem sets it to `"%20"` on load), so a
+    query value containing a space signed a URI the verifier could not
+    reproduce.
+
+  - A request with no query parameters no longer appends a stray `?`.
+
+  - A `params_encoder` configured on the connection or request is now
+    preserved, instead of being replaced with the default encoder.
+
 ## [0.8.0.beta2] - 2026-05-20
 
 - Add Web Bot Auth support, implementing the current IETF draft

data/lib/linzer/faraday/utils.rb

@@ -14,13 +14,20 @@ module Linzer
       # {Linzer::Message::Adapter::Faraday::Request}, preserving the
       # original HTTP method, URL, and headers from the environment.
       #
+      # Preserves the environment's request options when present, so that
+      # a +params_encoder+ configured on the connection or request is
+      # carried over. The adapter re-encodes query parameters when
+      # deriving +@target-uri+ and friends, and must use the same encoder
+      # Faraday used to write the URL, or the signed value will not match
+      # the URI actually sent.
+      #
       # @param env [::Faraday::Env] the middleware environment
       # @return [::Faraday::Request] a new request object
       def self.create_request(env)
         ::Faraday::Request.create(env.method) do |req|
           req.params  = ::Faraday::Utils::ParamsHash.new
           req.headers = ::Faraday::Utils::Headers.new(env.request_headers.dup)
-          req.options = ::Faraday::ConnectionOptions.from(nil).request
+          req.options = env.request || ::Faraday::ConnectionOptions.from(nil).request
           req.url       env.url
         end
       end

data/lib/linzer/message/adapter/faraday/request.rb

@@ -37,10 +37,24 @@ module Linzer
 
           # Builds the full URI including query parameters.
           #
+          # Encodes the query with the request's own +params_encoder+,
+          # mirroring how faraday builds the URL it puts on the wire
+          # (+Faraday::Connection#build_env+). Encoding it independently
+          # here would diverge from the URI actually sent: notably
+          # +URI.encode_www_form+ always encodes a space as +++, while
+          # faraday honours the process-wide
+          # +Faraday::Utils.default_space_encoding+, which other gems may
+          # set to +%20+. The signer would then cover a +@target-uri+ the
+          # verifier cannot reproduce from the request it received.
+          #
+          # An empty query is left as +nil+ rather than +""+, as assigning
+          # +""+ would append a stray +?+ that faraday does not send.
+          #
           # @return [URI] the complete request URI with encoded query string
           def uri
             uri = @operation.path.dup
-            uri.query = URI.encode_www_form(@operation.params)
+            query = @operation.params.to_query(@operation.options.params_encoder)
+            uri.query = query unless query.empty?
             uri
           end
 

data/lib/linzer/version.rb

@@ -3,5 +3,5 @@
 module Linzer
   # Current version of the Linzer gem.
   # @return [String]
-  VERSION = "0.8.0.beta2"
+  VERSION = "0.8.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.8.0.beta2
+  version: 0.8.0
 platform: ruby
 authors:
 - Miguel Landaeta