serge 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd9ed2d4820a6121a5f0b4539ade121e54d55af302a42144879f91c15bff1375
-  data.tar.gz: 251d4173c7836cdf85f5d0dfe56585dc93937f26018a5c08d88c2b9faf8776db
+  metadata.gz: 1ddf846378e4991b3739c64cb37257ad0d584212e963a14feb991ac2922219c2
+  data.tar.gz: db98af509011dcf2955601d39cc691e9723e701432bbf8ac36c1c842a343ecf5
 SHA512:
-  metadata.gz: a25124728926af3ddf194e6b1d869f7b1e8a8aec009db2cd667c0ff848b6b2cadd99b091ad1cfd3eaf7aabd852cebe41846e2eb06e561de79bc32e328c38eea7
-  data.tar.gz: 99b41d570a88802bc638da8df1529baa9f0ff999eee33ed2c57c45dbbf6b3f62478aeea3e882974f0fda25aa7ce122123e5ae9d14674214c87a1b0b765e5ebba
+  metadata.gz: b5b9bb3afa094e3383a676be914c7e716079f4aca68c883e7c04028bf78712b5eb2bff8f69b0731653ec9f5c1f3c4a863ff29760f6e9f7494d75130d874a66c5
+  data.tar.gz: f7479060ea773d8bf07e6e40c2a2871a046fbf7eee4a70be288ba61ba850f96d4efb007a80dcf182b352cf7606878feea730854fc88c0e4a88fbf3e2bbcaeb53

data/README.md

@@ -39,6 +39,24 @@ rescue Serge::SignatureVerificationError => e
 end
 ```
 
+For outgoing message headers, both legacy and RFC 9421 share the same API method:
+
+```ruby
+    headers = {}
+    # given legacy_signature which is true or false
+    klass = legacy_signature ? Serge::FediSignature : Serge::MessageSignature
+
+    headers.merge!(
+      klass.headers(
+        method: method_string,
+        url: target_url,
+        body: body,
+        public_key_id: public_key_url,
+        private_key: private_key
+      )
+    )
+```
+
 You can also set the logger in a Rails initializer like `config/initializers/serge.rb`:
 
 ```ruby

data/lib/serge/fedi_signature.rb

@@ -2,6 +2,33 @@ module Serge
   class FediSignature
     ALGORITHM = 'rsa-sha256'
 
+    def self.headers(method:, url:, body:, public_key_id:, private_key:)
+      signature_headers = {}
+
+      date = Time.now.utc.httpdate
+      signature_headers['Date'] = date
+
+      header_names = ['(request-target)', 'host', 'date']
+      if body.present?
+        header_names << 'digest'
+        digest = "SHA-256=#{Digest::SHA256.base64digest(body)}"
+        signature_headers['Digest'] = digest
+      end
+
+      header_values = {
+        '(request-target)' => "#{method} #{url.path}",
+        'host' => url.host,
+        'date' => date,
+        'digest' => digest,
+      }
+
+      signing_string = signing_string(header_names) { |name| header_values[name] }
+
+      signature = sign(signing_string, private_key)
+
+      signature_headers.merge({'Signature' => build_header(public_key_id, signature, header_names)})
+    end
+
     def self.signing_string(header_names)
       header_names.map { |name| "#{name}: #{yield(name)}" }.join("\n")
     end

data/lib/serge/inbox_delivery/http_legacy_signature.rb

@@ -67,6 +67,8 @@ module Serge
         end
 
         result
+      rescue OpenSSL::PKey::PKeyError => e
+        raise Serge::SignatureVerificationError, "Invalid public key: #{e.message}"
       end
 
       def verified?(public_key)

data/lib/serge/inbox_delivery/http_message_signature.rb

@@ -69,6 +69,8 @@ module Serge
         Linzer.verify!(Rack::Request.new(@request.env), key:)
       rescue Linzer::VerifyError
         false
+      rescue OpenSSL::PKey::PKeyError => e
+        raise Serge::SignatureVerificationError, "Invalid public key: #{e.message}"
       end
 
       private

data/lib/serge/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Serge
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: serge
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Tom Brown
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-10-24 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -86,7 +85,6 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/herestomwiththeweather/serge
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -101,8 +99,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key: 
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Ruby HTTP Signature for Fedi Inbox Deliveries
 test_files: []