serge 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d123b881b2747c9be15783a3acc8f79af45aacf0e9823708c504bdd83877c04
-  data.tar.gz: aef408116087ad1eb5427f777766c4ac44880dece234772416455784641ffdc6
+  metadata.gz: dd9ed2d4820a6121a5f0b4539ade121e54d55af302a42144879f91c15bff1375
+  data.tar.gz: 251d4173c7836cdf85f5d0dfe56585dc93937f26018a5c08d88c2b9faf8776db
 SHA512:
-  metadata.gz: 22b4f55ebbb5b38a9eef5fe699ff17421e9bfa56eb208a6dfc0a9f698364c2f17e48a1a68619f11168cdc1c0a7d27ab2bf1fd32da003898b94e62b6a92c7c625
-  data.tar.gz: 5a497cf2a756d26ac3d1165d77eaeab1c6385e323daa5751446f909626706c2e48bf41fbb6415f94162f15f9de72d8128a581031cea9ecbefc7729666c0b6c92
+  metadata.gz: a25124728926af3ddf194e6b1d869f7b1e8a8aec009db2cd667c0ff848b6b2cadd99b091ad1cfd3eaf7aabd852cebe41846e2eb06e561de79bc32e328c38eea7
+  data.tar.gz: 99b41d570a88802bc638da8df1529baa9f0ff999eee33ed2c57c45dbbf6b3f62478aeea3e882974f0fda25aa7ce122123e5ae9d14674214c87a1b0b765e5ebba

data/README.md

@@ -1,28 +1,49 @@
 # Serge
 
-TODO: Delete this and the text below, and describe your gem
-
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/serge`. To experiment with that code, run `bin/console` for an interactive prompt.
+A Ruby library to handle HTTP signatures for inbox deliveries on the Fediverse.
 
 ## Installation
 
-TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
-
 Install the gem and add to the application's Gemfile by executing:
 
 ```bash
-bundle add UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+bundle add serge
 ```
 
 If bundler is not being used to manage dependencies, install the gem by executing:
 
 ```bash
-gem install UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+gem install serge
 ```
 
 ## Usage
 
-TODO: Write usage instructions here
+There are 2 HTTP signature formats (draft-cavage and [RFC 9421](https://www.rfc-editor.org/info/rfc9421/)) in use on the Fediverse. `InboxDelivery` handles both formats with one interface.
+
+For incoming messages, inside of a Rails controller method:
+
+```ruby
+begin
+  inbox_delivery = Serge::InboxDelivery.new(request)
+  key_id = inbox_delivery.key_id
+  # public_key = YOUR_CODE_TO_RETRIEVE_PUBLIC_KEY_FROM_KEY_ID
+
+  # verify the signature using the PEM-encoded RSA public key
+  if inbox_delivery.verified?(public_key)
+    # signature is valid
+  else
+    # signature is not valid
+  end
+rescue Serge::SignatureVerificationError => e
+  # YOUR_CODE_TO_HANDLE_EXCEPTION
+end
+```
+
+You can also set the logger in a Rails initializer like `config/initializers/serge.rb`:
+
+```ruby
+Serge::InboxDelivery.logger = Rails.logger
+```
 
 ## Development
 
@@ -32,8 +53,8 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/serge. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/serge/blob/main/CODE_OF_CONDUCT.md).
+Bug reports and pull requests are welcome on GitHub at https://github.com/herestomwiththeweather/serge. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/herestomwiththeweather/serge/blob/main/CODE_OF_CONDUCT.md).
 
 ## Code of Conduct
 
-Everyone interacting in the Serge project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/serge/blob/main/CODE_OF_CONDUCT.md).
+Everyone interacting in the Serge project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/herestomwiththeweather/serge/blob/main/CODE_OF_CONDUCT.md).

data/lib/serge/message_signature.rb

@@ -0,0 +1,22 @@
+module Serge
+  class MessageSignature
+    def self.headers(method:, url:, body:, public_key_id:, private_key:)
+      components = %w[@method @target-uri]
+
+      signature_headers = {}
+      if body.present?
+        signature_headers['Content-Digest'] = "sha-256=:#{Digest::SHA256.base64digest(body)}:"
+        components << 'content-digest'
+      end
+
+      temp_request = Net::HTTP.const_get(method.capitalize).new(URI(url), signature_headers)
+      key = Linzer.new_rsa_v1_5_sha256_key(private_key, public_key_id)
+      Linzer.sign!(temp_request, key: key, components: components)
+
+      signature_headers.merge({
+        'Signature-Input' => temp_request['signature-input'],
+        'Signature' => temp_request['signature']
+      })
+    end
+  end
+end

data/lib/serge/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Serge
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/serge.rb

@@ -16,4 +16,5 @@ end
 require 'serge/error.rb'
 require 'serge/signature_verification_error.rb'
 require 'serge/fedi_signature.rb'
+require 'serge/message_signature.rb'
 require 'serge/inbox_delivery.rb'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: serge
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Tom Brown
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-09-28 00:00:00.000000000 Z
+date: 2026-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -78,6 +78,7 @@ files:
 - lib/serge/inbox_delivery.rb
 - lib/serge/inbox_delivery/http_legacy_signature.rb
 - lib/serge/inbox_delivery/http_message_signature.rb
+- lib/serge/message_signature.rb
 - lib/serge/signature_verification_error.rb
 - lib/serge/version.rb
 homepage: https://github.com/herestomwiththeweather/serge