serge 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d123b881b2747c9be15783a3acc8f79af45aacf0e9823708c504bdd83877c04
-  data.tar.gz: aef408116087ad1eb5427f777766c4ac44880dece234772416455784641ffdc6
+  metadata.gz: 1ddf846378e4991b3739c64cb37257ad0d584212e963a14feb991ac2922219c2
+  data.tar.gz: db98af509011dcf2955601d39cc691e9723e701432bbf8ac36c1c842a343ecf5
 SHA512:
-  metadata.gz: 22b4f55ebbb5b38a9eef5fe699ff17421e9bfa56eb208a6dfc0a9f698364c2f17e48a1a68619f11168cdc1c0a7d27ab2bf1fd32da003898b94e62b6a92c7c625
-  data.tar.gz: 5a497cf2a756d26ac3d1165d77eaeab1c6385e323daa5751446f909626706c2e48bf41fbb6415f94162f15f9de72d8128a581031cea9ecbefc7729666c0b6c92
+  metadata.gz: b5b9bb3afa094e3383a676be914c7e716079f4aca68c883e7c04028bf78712b5eb2bff8f69b0731653ec9f5c1f3c4a863ff29760f6e9f7494d75130d874a66c5
+  data.tar.gz: f7479060ea773d8bf07e6e40c2a2871a046fbf7eee4a70be288ba61ba850f96d4efb007a80dcf182b352cf7606878feea730854fc88c0e4a88fbf3e2bbcaeb53

data/README.md

@@ -1,28 +1,67 @@
 # Serge
 
-TODO: Delete this and the text below, and describe your gem
-
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/serge`. To experiment with that code, run `bin/console` for an interactive prompt.
+A Ruby library to handle HTTP signatures for inbox deliveries on the Fediverse.
 
 ## Installation
 
-TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
-
 Install the gem and add to the application's Gemfile by executing:
 
 ```bash
-bundle add UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+bundle add serge
 ```
 
 If bundler is not being used to manage dependencies, install the gem by executing:
 
 ```bash
-gem install UPDATE_WITH_YOUR_GEM_NAME_IMMEDIATELY_AFTER_RELEASE_TO_RUBYGEMS_ORG
+gem install serge
 ```
 
 ## Usage
 
-TODO: Write usage instructions here
+There are 2 HTTP signature formats (draft-cavage and [RFC 9421](https://www.rfc-editor.org/info/rfc9421/)) in use on the Fediverse. `InboxDelivery` handles both formats with one interface.
+
+For incoming messages, inside of a Rails controller method:
+
+```ruby
+begin
+  inbox_delivery = Serge::InboxDelivery.new(request)
+  key_id = inbox_delivery.key_id
+  # public_key = YOUR_CODE_TO_RETRIEVE_PUBLIC_KEY_FROM_KEY_ID
+
+  # verify the signature using the PEM-encoded RSA public key
+  if inbox_delivery.verified?(public_key)
+    # signature is valid
+  else
+    # signature is not valid
+  end
+rescue Serge::SignatureVerificationError => e
+  # YOUR_CODE_TO_HANDLE_EXCEPTION
+end
+```
+
+For outgoing message headers, both legacy and RFC 9421 share the same API method:
+
+```ruby
+    headers = {}
+    # given legacy_signature which is true or false
+    klass = legacy_signature ? Serge::FediSignature : Serge::MessageSignature
+
+    headers.merge!(
+      klass.headers(
+        method: method_string,
+        url: target_url,
+        body: body,
+        public_key_id: public_key_url,
+        private_key: private_key
+      )
+    )
+```
+
+You can also set the logger in a Rails initializer like `config/initializers/serge.rb`:
+
+```ruby
+Serge::InboxDelivery.logger = Rails.logger
+```
 
 ## Development
 
@@ -32,8 +71,8 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/serge. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/serge/blob/main/CODE_OF_CONDUCT.md).
+Bug reports and pull requests are welcome on GitHub at https://github.com/herestomwiththeweather/serge. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/herestomwiththeweather/serge/blob/main/CODE_OF_CONDUCT.md).
 
 ## Code of Conduct
 
-Everyone interacting in the Serge project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/serge/blob/main/CODE_OF_CONDUCT.md).
+Everyone interacting in the Serge project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/herestomwiththeweather/serge/blob/main/CODE_OF_CONDUCT.md).

data/lib/serge/fedi_signature.rb

@@ -2,6 +2,33 @@ module Serge
   class FediSignature
     ALGORITHM = 'rsa-sha256'
 
+    def self.headers(method:, url:, body:, public_key_id:, private_key:)
+      signature_headers = {}
+
+      date = Time.now.utc.httpdate
+      signature_headers['Date'] = date
+
+      header_names = ['(request-target)', 'host', 'date']
+      if body.present?
+        header_names << 'digest'
+        digest = "SHA-256=#{Digest::SHA256.base64digest(body)}"
+        signature_headers['Digest'] = digest
+      end
+
+      header_values = {
+        '(request-target)' => "#{method} #{url.path}",
+        'host' => url.host,
+        'date' => date,
+        'digest' => digest,
+      }
+
+      signing_string = signing_string(header_names) { |name| header_values[name] }
+
+      signature = sign(signing_string, private_key)
+
+      signature_headers.merge({'Signature' => build_header(public_key_id, signature, header_names)})
+    end
+
     def self.signing_string(header_names)
       header_names.map { |name| "#{name}: #{yield(name)}" }.join("\n")
     end

data/lib/serge/inbox_delivery/http_legacy_signature.rb

@@ -67,6 +67,8 @@ module Serge
         end
 
         result
+      rescue OpenSSL::PKey::PKeyError => e
+        raise Serge::SignatureVerificationError, "Invalid public key: #{e.message}"
       end
 
       def verified?(public_key)

data/lib/serge/inbox_delivery/http_message_signature.rb

@@ -69,6 +69,8 @@ module Serge
         Linzer.verify!(Rack::Request.new(@request.env), key:)
       rescue Linzer::VerifyError
         false
+      rescue OpenSSL::PKey::PKeyError => e
+        raise Serge::SignatureVerificationError, "Invalid public key: #{e.message}"
       end
 
       private

data/lib/serge/message_signature.rb

@@ -0,0 +1,22 @@
+module Serge
+  class MessageSignature
+    def self.headers(method:, url:, body:, public_key_id:, private_key:)
+      components = %w[@method @target-uri]
+
+      signature_headers = {}
+      if body.present?
+        signature_headers['Content-Digest'] = "sha-256=:#{Digest::SHA256.base64digest(body)}:"
+        components << 'content-digest'
+      end
+
+      temp_request = Net::HTTP.const_get(method.capitalize).new(URI(url), signature_headers)
+      key = Linzer.new_rsa_v1_5_sha256_key(private_key, public_key_id)
+      Linzer.sign!(temp_request, key: key, components: components)
+
+      signature_headers.merge({
+        'Signature-Input' => temp_request['signature-input'],
+        'Signature' => temp_request['signature']
+      })
+    end
+  end
+end

data/lib/serge/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Serge
-  VERSION = "0.1.0"
+  VERSION = "0.3.0"
 end

data/lib/serge.rb

@@ -16,4 +16,5 @@ end
 require 'serge/error.rb'
 require 'serge/signature_verification_error.rb'
 require 'serge/fedi_signature.rb'
+require 'serge/message_signature.rb'
 require 'serge/inbox_delivery.rb'

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: serge
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Tom Brown
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-09-28 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -78,6 +77,7 @@ files:
 - lib/serge/inbox_delivery.rb
 - lib/serge/inbox_delivery/http_legacy_signature.rb
 - lib/serge/inbox_delivery/http_message_signature.rb
+- lib/serge/message_signature.rb
 - lib/serge/signature_verification_error.rb
 - lib/serge/version.rb
 homepage: https://github.com/herestomwiththeweather/serge
@@ -85,7 +85,6 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/herestomwiththeweather/serge
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -100,8 +99,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key: 
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Ruby HTTP Signature for Fedi Inbox Deliveries
 test_files: []