redbot 2.4.2__tar.gz → 2.5.0__tar.gz

{redbot-2.4.2/redbot.egg-info → redbot-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redbot
-Version: 2.4.2
+Version: 2.5.0
 Summary: REDbot is lint for HTTP.
 Author-email: Mark Nottingham <mnot@mnot.net>
 License-Expression: MIT
@@ -16,6 +16,8 @@ Classifier: Operating System :: MacOS :: MacOS X
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE.md
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: http-sf>=1.0
 Requires-Dist: httplint>=2026.05.01
 Requires-Dist: importlib_resources
 Requires-Dist: Jinja2>=3.1.2
@@ -113,6 +115,46 @@ or
 > podman run --rm -p 8000:8000 ghcr.io/mnot/redbot
 
 
+## Web Bot Auth
+
+REDbot can authenticate its outgoing requests using [Web Bot Auth](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), which signs requests with an Ed25519 key using [HTTP Message Signatures (RFC 9421)](https://www.rfc-editor.org/rfc/rfc9421). This lets origins verify that requests genuinely come from your REDbot instance. The implementation follows the IETF drafts and is not specific to any one verifier.
+
+Requests are sent unsigned by default. REDbot only attaches a signature when the origin challenges for one -- that is, when it returns a `401`, `403`, or `429` response carrying an `Accept-Signature` header -- and then transparently retries the request signed. This avoids advertising the bot's identity to servers that don't ask for it.
+
+### Generating a key
+
+Create an Ed25519 private key in PEM form:
+
+~~~ bash
+> openssl genpkey -algorithm ed25519 -out web-bot-auth-key.pem
+~~~
+
+Keep this file private and readable by the REDbot process. The matching public key is published automatically (see below); you do not need to extract it yourself.
+
+### Configuring
+
+Set these in `config.txt` (for `redbot_daemon`):
+
+~~~ ini
+web_bot_auth_key = /path/to/web-bot-auth-key.pem
+web_bot_auth_directory = https://your-redbot.example
+~~~
+
+`web_bot_auth_directory` is the HTTPS origin where your public key directory is hosted. When you run `redbot_daemon`, it serves that directory at `/.well-known/http-message-signatures-directory` (a JWKS, self-signed per the spec), so a verifier can fetch your public key. Make sure that path is reachable at the origin you configured.
+
+`web_bot_auth_directory` is optional: if you omit it, REDbot uses the origin of `ui_uri`. Because `ui_uri` defaults to `https://redbot.org/`, **enabling signing requires `ui_uri` to be set to your instance's real public origin** — otherwise you would publish the wrong bot identity. Set `web_bot_auth_directory` explicitly if your key directory lives on a different origin than the UI.
+
+For the command-line tool, pass the equivalent flags (there is no `ui_uri`, so the directory is required):
+
+~~~ bash
+> redbot --web-bot-auth-key web-bot-auth-key.pem --web-bot-auth-directory https://your-redbot.example https://example.com/
+~~~
+
+### Registering with a verifier
+
+To be recognised by a specific verifier, register your directory URL with them according to their process.
+
+
 ## Credits
 
 Icons by [Font Awesome](https://fontawesome.com/). REDbot includes code from [tippy.js](https://atomiks.github.io/tippyjs/) and [prettify.js](https://github.com/google/code-prettify).

{redbot-2.4.2 → redbot-2.5.0}/README.md

@@ -67,6 +67,46 @@ or
 > podman run --rm -p 8000:8000 ghcr.io/mnot/redbot
 
 
+## Web Bot Auth
+
+REDbot can authenticate its outgoing requests using [Web Bot Auth](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), which signs requests with an Ed25519 key using [HTTP Message Signatures (RFC 9421)](https://www.rfc-editor.org/rfc/rfc9421). This lets origins verify that requests genuinely come from your REDbot instance. The implementation follows the IETF drafts and is not specific to any one verifier.
+
+Requests are sent unsigned by default. REDbot only attaches a signature when the origin challenges for one -- that is, when it returns a `401`, `403`, or `429` response carrying an `Accept-Signature` header -- and then transparently retries the request signed. This avoids advertising the bot's identity to servers that don't ask for it.
+
+### Generating a key
+
+Create an Ed25519 private key in PEM form:
+
+~~~ bash
+> openssl genpkey -algorithm ed25519 -out web-bot-auth-key.pem
+~~~
+
+Keep this file private and readable by the REDbot process. The matching public key is published automatically (see below); you do not need to extract it yourself.
+
+### Configuring
+
+Set these in `config.txt` (for `redbot_daemon`):
+
+~~~ ini
+web_bot_auth_key = /path/to/web-bot-auth-key.pem
+web_bot_auth_directory = https://your-redbot.example
+~~~
+
+`web_bot_auth_directory` is the HTTPS origin where your public key directory is hosted. When you run `redbot_daemon`, it serves that directory at `/.well-known/http-message-signatures-directory` (a JWKS, self-signed per the spec), so a verifier can fetch your public key. Make sure that path is reachable at the origin you configured.
+
+`web_bot_auth_directory` is optional: if you omit it, REDbot uses the origin of `ui_uri`. Because `ui_uri` defaults to `https://redbot.org/`, **enabling signing requires `ui_uri` to be set to your instance's real public origin** — otherwise you would publish the wrong bot identity. Set `web_bot_auth_directory` explicitly if your key directory lives on a different origin than the UI.
+
+For the command-line tool, pass the equivalent flags (there is no `ui_uri`, so the directory is required):
+
+~~~ bash
+> redbot --web-bot-auth-key web-bot-auth-key.pem --web-bot-auth-directory https://your-redbot.example https://example.com/
+~~~
+
+### Registering with a verifier
+
+To be recognised by a specific verifier, register your directory URL with them according to their process.
+
+
 ## Credits
 
 Icons by [Font Awesome](https://fontawesome.com/). REDbot includes code from [tippy.js](https://atomiks.github.io/tippyjs/) and [prettify.js](https://github.com/google/code-prettify).

{redbot-2.4.2 → redbot-2.5.0}/pyproject.toml

@@ -20,6 +20,8 @@ classifiers = [
 ]
 license-files = ["LICENSE.md"]
 dependencies = [
+    "cryptography >= 42.0.0",
+    "http-sf >= 1.0",
     "httplint >= 2026.05.01",
     "importlib_resources",
     "Jinja2 >= 3.1.2",
@@ -74,42 +76,5 @@ namespaces = false
 [tool.setuptools]
 include-package-data = true
 
-[tool.mypy]
-strict = true
-show_error_codes = true
-
-[tool.pylint.basic]
-function-rgx = "[a-z_][a-z0-9_]{1,30}$"
-variable-rgx = "[a-z_][a-z0-9_]{1,30}$"
-attr-rgx = "[a-z_][a-z0-9_]{1,30}$"
-argument-rgx = "[a-z_][a-z0-9_]{1,30}$"
-class-attribute-rgx = "([A-Za-z_][A-Za-z0-9_]{1,30}|(__.*__))$"
-method-rgx = "[a-z_][a-z0-9_]{1,30}$"
-class-rgx = "[a-zA-Z0-9_]+$"
-
-[tool.pylint.messages_control]
-disable = "C0114,C0115,C0116,W0613,R0903"
-
-[tool.pylint.reports]
-reports = false
-
-[tool.pylint.variables]
-dummy-variables-rgx = "response_start|response_body|response_done|error|formatter_done|check_done|_"
-
-[tool.pylint.design]
-max-args=10
-max-positional-arguments=10
-max-locals=35
-max-branches=25
-max-statements=100
-max-attributes=40
-min-public-methods=1
-
-[tool.pylint.similarities]
-min-similarity-lines = 10
-
 [tool.black]
 line-length = 100
-
-[tool.isort]
-profile = "black"

{redbot-2.4.2 → redbot-2.5.0}/redbot/__init__.py

@@ -2,7 +2,7 @@
 This is the Resource Expert Droid.
 """
 
-__version__ = "2.4.2"
+__version__ = "2.5.0"
 __author__ = "Mark Nottingham <mnot@mnot.net>"
 __copyright__ = """\
 Copyright (c) 2008- Mark Nottingham

{redbot-2.4.2 → redbot-2.5.0}/redbot/cli.py

@@ -12,6 +12,7 @@ import thor
 
 from redbot.formatter import available_formatters, find_formatter
 from redbot.resource import HttpResource
+from redbot.webbotauth import WebBotAuthError, load_signer
 
 
 def main() -> None:
@@ -38,12 +39,35 @@ def main() -> None:
         default="text",
         help="output format",
     )
+    parser.add_argument(
+        "--web-bot-auth-key",
+        action="store",
+        dest="web_bot_auth_key",
+        help="path to an Ed25519 private key (PEM) for signing requests with Web Bot Auth",
+    )
+    parser.add_argument(
+        "--web-bot-auth-directory",
+        action="store",
+        dest="web_bot_auth_directory",
+        help="HTTPS origin hosting this bot's key directory (the Signature-Agent value)",
+    )
     args = parser.parse_args()
 
+    redbot_config = {"enable_local_access": "True"}
+    if args.web_bot_auth_key:
+        redbot_config["web_bot_auth_key"] = args.web_bot_auth_key
+    if args.web_bot_auth_directory:
+        redbot_config["web_bot_auth_directory"] = args.web_bot_auth_directory
     config_parser = ConfigParser()
-    config_parser.read_dict({"redbot": {"enable_local_access": "True"}})
+    config_parser.read_dict({"redbot": redbot_config})
     config = config_parser["redbot"]
 
+    try:
+        load_signer(config)  # validate Web Bot Auth config up front
+    except WebBotAuthError as why:
+        sys.stderr.write(f"Web Bot Auth configuration error: {why}\n")
+        sys.exit(1)
+
     resource = HttpResource(config, descend=args.descend)
     resource.set_request(args.url)
 

{redbot-2.4.2 → redbot-2.5.0}/redbot/daemon.py

@@ -34,6 +34,13 @@ from thor.tcp import TcpConnection
 
 import redbot
 from redbot.type import RawHeaderListType
+from redbot.webbotauth import (
+    DIRECTORY_CONTENT_TYPE,
+    DIRECTORY_MAX_AGE,
+    DIRECTORY_PATH,
+    WebBotAuthError,
+    load_signer,
+)
 from redbot.webui import RedWebUi
 from redbot.webui.saved_tests import clean_saved_tests
 
@@ -78,6 +85,15 @@ class RedBotServer:
         if SYSTEMD_NOTIFIER is not None:
             thor.schedule(self.watchdog_freq, self.watchdog_ping)
 
+        # Set up Web Bot Auth signing (validate config up front).
+        try:
+            self.signer = load_signer(config)
+        except WebBotAuthError as why:
+            self.console(f"FATAL: Web Bot Auth configuration error: {why}")
+            sys.exit(1)
+        if self.signer is not None:
+            self.console(f"Web Bot Auth enabled (keyid {self.signer.keyid})")
+
         self.static_files = resource_files("redbot.assets")
         self.extra_files = {}
         extra_base_dir = self.config.get("extra_base_dir", None)
@@ -342,6 +358,8 @@ class RedRequestHandler:
             p_uri = urlsplit(self.uri)
         except UnicodeDecodeError:
             return self.bad_request(b"That's not a URL.")
+        if p_uri.path == DIRECTORY_PATH.encode("ascii"):
+            return self.serve_directory()
         if (
             p_uri.path.startswith(self.server.static_root + b"/")
             or p_uri.path in self.server.extra_files
@@ -407,6 +425,38 @@ in standalone server mode. Details follow.
         self.exchange.response_done([])
         return None
 
+    def serve_directory(self) -> None:
+        "Serve the Web Bot Auth key directory (a self-signed JWKS)."
+        signer = self.server.signer
+        if signer is None:
+            return self.not_found(DIRECTORY_PATH.encode("ascii"))
+        body = signer.directory_json()
+        headers = [
+            (b"Content-Type", DIRECTORY_CONTENT_TYPE.encode("ascii")),
+            (b"Cache-Control", b"max-age=%d" % DIRECTORY_MAX_AGE),
+        ]
+        authority = self.request_authority()
+        if authority:
+            headers += signer.sign_directory(authority)
+        self.exchange.response_start(b"200", b"OK", headers)
+        self.exchange.response_body(body)
+        self.exchange.response_done([])
+        return None
+
+    def request_authority(self) -> str:
+        "The authority (Host) of the incoming request, for signing."
+        for name, value in self.req_hdrs:
+            if name.lower() == b"host":
+                host = value.decode("ascii", "replace").strip().lower()
+                # Drop a default port so the signed @authority matches what a
+                # verifier normalizes to (RFC 9421 derives @authority this way).
+                for suffix in (":443", ":80"):
+                    if host.endswith(suffix):
+                        host = host[: -len(suffix)]
+                        break
+                return host
+        return ""
+
     def not_found(self, path: bytes) -> None:
         headers = []
         headers.append((b"Content-Type", b"text/plain"))

{redbot-2.4.2 → redbot-2.5.0}/redbot/resource/fetch.py

@@ -21,8 +21,28 @@ from redbot import __version__
 from redbot.i18n import _
 from redbot.note import RedbotNote
 from redbot.type import RawHeaderListType, StrHeaderListType
+from redbot.webbotauth import WebBotAuthError, load_signer
 
-UA_STRING = f"RED/{__version__} (https://redbot.org/)".encode("ascii")
+# Fallback UI URL advertised in the User-Agent when ui_uri is not configured
+# (e.g. the CLI). The public instance's ui_uri defaults to the same value.
+DEFAULT_UI_URI = "https://redbot.org/"
+
+
+def ua_string(config: SectionProxy) -> bytes:
+    "The User-Agent for outgoing requests, pointing at this instance's UI URL."
+    uri = config.get("ui_uri", "").strip() or DEFAULT_UI_URI
+    return f"RED/{__version__} ({uri})".encode("ascii", "replace")
+
+
+# Status codes on which a response carrying an Accept-Signature header is treated
+# as a Web Bot Auth challenge to re-send the request signed
+# (draft-meunier-web-bot-auth-architecture, Section 4.3).
+WBA_CHALLENGE_STATUSES = {b"401", b"403", b"429"}
+
+
+def _has_accept_signature(res_headers: RawHeaderListType) -> bool:
+    "Whether the response asks the client to sign (RFC 9421 Accept-Signature)."
+    return any(name.lower() == b"accept-signature" for name, _v in res_headers)
 
 
 class RedHttpClient(thor.http.HttpClient):
@@ -74,6 +94,7 @@ class RedFetcher(thor.events.EventEmitter):
         self.fetch_started = False
         self.fetch_error: Optional[httperr.HttpError] = None
         self.fetch_done = False
+        self._wba_retried = False
         self.setup_check_ip()
 
     def __getstate__(self) -> Dict[str, Any]:
@@ -159,7 +180,15 @@ class RedFetcher(thor.events.EventEmitter):
         assert self.request.uri, "uri not set in check"
 
         if "user-agent" not in [i[0].lower() for i in self.request.headers.text]:
-            self.request.headers.process([(b"User-Agent", UA_STRING)])
+            self.request.headers.process([(b"User-Agent", ua_string(self.config))])
+        # Requests are sent unsigned; Web Bot Auth signatures are only added when
+        # the origin challenges for them (see _response_start).
+        self._send_request()
+
+    def _send_request(self, extra_headers: Optional[RawHeaderListType] = None) -> None:
+        "Start an exchange for the current request, optionally adding extra headers."
+        assert self.request.method, "method not set in _send_request"
+        assert self.request.uri, "uri not set in _send_request"
         self.exchange = self.client.exchange()
         self.exchange.on("response_nonfinal", self._response_nonfinal)
         self.exchange.once("response_start", self._response_start)
@@ -176,6 +205,8 @@ class RedFetcher(thor.events.EventEmitter):
             (k.encode("ascii", "replace"), v.encode("ascii", "replace"))
             for (k, v) in self.request.headers.text
         ]
+        if extra_headers:
+            req_hdrs += extra_headers
         self.request.start_time = time.time()
         self.exchange.request_start(
             self.request.method.encode("ascii"),
@@ -189,6 +220,19 @@ class RedFetcher(thor.events.EventEmitter):
         if not self.fetch_done:  # the request could have immediately failed.
             self.exchange.request_done([])
 
+    def _abort_exchange(self) -> None:
+        "Detach from and close the current exchange (e.g. to retry the request)."
+        if hasattr(self, "exchange"):
+            self.exchange.remove_listeners(
+                "response_nonfinal",
+                "response_start",
+                "response_body",
+                "response_done",
+                "error",
+            )
+            if self.exchange.conn:
+                self.exchange.conn.close()
+
     def _response_nonfinal(
         self, status: bytes, phrase: bytes, res_headers: RawHeaderListType
     ) -> None:
@@ -219,6 +263,26 @@ class RedFetcher(thor.events.EventEmitter):
         "Process the response start-line and headers."
         if self.fetch_done:
             return
+        if not self._wba_retried and status in WBA_CHALLENGE_STATUSES and self.request.uri:
+            if _has_accept_signature(res_headers):
+                try:
+                    signer = load_signer(self.config)
+                except WebBotAuthError as why:
+                    # A key problem arising mid-run (e.g. rotated to a bad file)
+                    # should not crash the fetch; just proceed unsigned.
+                    self.emit("debug", f"Web Bot Auth disabled for this request: {why}")
+                    signer = None
+                if signer is not None:
+                    self._wba_retried = True
+                    self.emit(
+                        "debug",
+                        f"Web Bot Auth challenge for {self.request.uri}; retrying signed",
+                    )
+                    self._abort_exchange()
+                    self.nonfinal_responses = []
+                    self.transfer_out = 0
+                    self._send_request(signer.sign_request(self.request.uri))
+                    return
         self.response.start_time = time.time()
         assert self.exchange.res_version, "exchange.res_version not set in _response_start"
         self.response.process_response_topline(self.exchange.res_version, status, phrase)

redbot-2.5.0/redbot/webbotauth.py

@@ -0,0 +1,244 @@
+"""
+Web Bot Auth support for REDbot.
+
+Web Bot Auth lets an automated client prove its identity to an origin by
+attaching an HTTP Message Signature (RFC 9421) to its requests, signed with an
+Ed25519 key whose public half is published in a directory at a well-known
+location.
+
+This module implements the IETF drafts
+(draft-meunier-web-bot-auth-architecture and
+draft-meunier-http-message-signatures-directory) and is not specific to any
+particular verifier.
+
+It provides:
+
+* ``WebBotAuthSigner`` - signs outgoing requests and the directory response.
+* ``load_signer`` - builds (and caches) a signer from REDbot configuration.
+"""
+
+import base64
+import hashlib
+import json
+import os
+import secrets
+import time
+from configparser import SectionProxy
+from typing import Dict, List, Optional, Tuple
+from urllib.parse import urlsplit
+
+import http_sf
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+# The tag identifying the purpose of a signature (draft-meunier-web-bot-auth).
+REQUEST_TAG = "web-bot-auth"
+# The tag for a signature over the directory response itself.
+DIRECTORY_TAG = "http-message-signatures-directory"
+# Where the key directory is served, relative to the origin root.
+DIRECTORY_PATH = "/.well-known/http-message-signatures-directory"
+# Media type for the key directory.
+DIRECTORY_CONTENT_TYPE = "application/http-message-signatures-directory+json"
+
+# Default lifetime of a request signature, in seconds. Web Bot Auth allows up to
+# 24h; we keep it short to limit the window for replay.
+DEFAULT_VALIDITY = 300
+# Lifetime of the directory response signature. The directory is cacheable for a
+# day (see DIRECTORY_MAX_AGE), so its signature must stay valid at least that
+# long, or a verifier re-checking a cached copy would see it expired.
+DIRECTORY_VALIDITY = 86400
+# Cache lifetime advertised for the directory, in seconds.
+DIRECTORY_MAX_AGE = 86400
+# The label tying together the Signature-Input and Signature dictionary members.
+SIG_LABEL = "sig1"
+
+
+class WebBotAuthError(Exception):
+    "Raised when Web Bot Auth is misconfigured."
+
+
+def _b64url(data: bytes) -> str:
+    "base64url-encode without padding (RFC 7515 / RFC 8037)."
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+class WebBotAuthSigner:
+    """
+    Signs requests and directory responses for Web Bot Auth.
+
+    ``key_pem`` is an Ed25519 private key in PEM (PKCS#8) form. ``directory`` is
+    the HTTPS origin that hosts this bot's key directory; it becomes the
+    Signature-Agent header value, and verifiers append the well-known directory
+    path to it. ``validity`` is the signature lifetime in seconds.
+    """
+
+    def __init__(
+        self,
+        key_pem: bytes,
+        directory: str,
+        validity: int = DEFAULT_VALIDITY,
+        key_created: Optional[int] = None,
+    ) -> None:
+        try:
+            key = serialization.load_pem_private_key(key_pem, password=None)
+        except (ValueError, TypeError) as why:
+            raise WebBotAuthError(f"Couldn't load Web Bot Auth key: {why}") from why
+        if not isinstance(key, Ed25519PrivateKey):
+            raise WebBotAuthError("Web Bot Auth key must be an Ed25519 private key.")
+        self._key = key
+        self.directory = directory.strip().strip('"')
+        self.validity = validity
+        self.key_created = key_created
+
+        raw_public = key.public_key().public_bytes(
+            serialization.Encoding.Raw, serialization.PublicFormat.Raw
+        )
+        self.public_x = _b64url(raw_public)
+        # RFC 8037 Appendix A.3 / RFC 7638: thumbprint over the canonical JWK
+        # (members lexicographically ordered, no whitespace).
+        thumb_input = json.dumps(
+            {"crv": "Ed25519", "kty": "OKP", "x": self.public_x},
+            separators=(",", ":"),
+            sort_keys=True,
+        ).encode("ascii")
+        self.keyid = _b64url(hashlib.sha256(thumb_input).digest())
+
+    @staticmethod
+    def authority(uri: str) -> str:
+        "The RFC 9421 @authority derived component for a target URI."
+        parts = urlsplit(uri)
+        host = (parts.hostname or "").lower()
+        default = {"http": 80, "https": 443}.get(parts.scheme.lower())
+        try:
+            port = parts.port
+        except ValueError:
+            port = None
+        if port is not None and port != default:
+            return f"{host}:{port}"
+        return host
+
+    def _build_signature(
+        self,
+        components: List[Tuple[str, str]],
+        tag: str,
+        validity: int,
+    ) -> Tuple[str, str]:
+        """
+        Construct the RFC 9421 signature base over ``components`` (each an
+        ordered (component-name, component-value) pair), sign it, and return the
+        Signature-Input and Signature dictionary-member values for SIG_LABEL.
+        ``validity`` is the signature lifetime in seconds.
+
+        Structured-field values are serialized with ``http_sf`` so the
+        @signature-params line in the base and the Signature-Input header are
+        produced identically.
+        """
+        created = int(time.time())
+        params: http_sf.types.ParamsType = {
+            "created": created,
+            "expires": created + validity,
+            "keyid": self.keyid,
+            "alg": "ed25519",
+            "nonce": base64.b64encode(secrets.token_bytes(32)).decode("ascii"),
+            "tag": tag,
+        }
+        covered: List[http_sf.types.ItemType] = [name for name, _ in components]
+        inner_list: http_sf.types.InnerListType = (covered, params)
+
+        base_lines = [f"{http_sf.ser(name)}: {value}" for name, value in components]
+        base_lines.append(f'{http_sf.ser("@signature-params")}: {http_sf.ser([inner_list])}')
+        signature = self._key.sign("\n".join(base_lines).encode("utf-8"))
+
+        return http_sf.ser({SIG_LABEL: inner_list}), http_sf.ser({SIG_LABEL: signature})
+
+    def sign_request(self, uri: str) -> List[Tuple[bytes, bytes]]:
+        "Return the Web Bot Auth headers to add to a request for ``uri``."
+        agent_field = http_sf.ser(self.directory)  # Signature-Agent value (an sf-string)
+        sig_input, sig = self._build_signature(
+            [("@authority", self.authority(uri)), ("signature-agent", agent_field)],
+            REQUEST_TAG,
+            self.validity,
+        )
+        return [
+            (b"Signature-Agent", agent_field.encode("ascii")),
+            (b"Signature-Input", sig_input.encode("ascii")),
+            (b"Signature", sig.encode("ascii")),
+        ]
+
+    def sign_directory(self, authority: str) -> List[Tuple[bytes, bytes]]:
+        "Return the signature headers for a directory response served at ``authority``."
+        sig_input, sig = self._build_signature(
+            [("@authority", authority)], DIRECTORY_TAG, DIRECTORY_VALIDITY
+        )
+        return [
+            (b"Signature-Input", sig_input.encode("ascii")),
+            (b"Signature", sig.encode("ascii")),
+        ]
+
+    def directory_json(self) -> bytes:
+        "The key directory body: a JWKS containing the public key."
+        key: Dict[str, object] = {
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": self.public_x,
+            "kid": self.keyid,
+            "use": "sig",
+        }
+        if self.key_created is not None:
+            key["nbf"] = self.key_created
+        return json.dumps({"keys": [key]}, separators=(",", ":")).encode("utf-8")
+
+
+_SIGNER_CACHE: Dict[str, WebBotAuthSigner] = {}
+
+
+def _ui_uri_origin(config: SectionProxy) -> str:
+    "The scheme://host[:port] origin of ui_uri, or '' if it isn't a usable URL."
+    parts = urlsplit(config.get("ui_uri", "").strip())
+    if not parts.scheme or not parts.netloc:
+        return ""
+    return f"{parts.scheme}://{parts.netloc}"
+
+
+def load_signer(config: SectionProxy) -> Optional[WebBotAuthSigner]:
+    """
+    Build a ``WebBotAuthSigner`` from REDbot configuration, or return None if
+    Web Bot Auth is not configured. Raises ``WebBotAuthError`` on misconfiguration
+    so problems surface at startup rather than mid-request. Successful signers are
+    cached, keyed by key path, directory, validity, and the key file's mtime.
+
+    The key directory location is ``web_bot_auth_directory``; if unset, it
+    defaults to the origin of ``ui_uri`` (so enabling signing requires ``ui_uri``
+    to be set correctly to this instance's public origin).
+    """
+    key_path = config.get("web_bot_auth_key", "").strip()
+    directory = config.get("web_bot_auth_directory", "").strip()
+    if not key_path:
+        if directory:
+            raise WebBotAuthError("web_bot_auth_directory is set but web_bot_auth_key is not.")
+        return None
+    if not directory:
+        directory = _ui_uri_origin(config)
+        if not directory:
+            raise WebBotAuthError(
+                "Web Bot Auth needs a key directory location: set web_bot_auth_directory, "
+                "or (for the daemon) set ui_uri to this instance's public origin."
+            )
+    validity = config.getint("web_bot_auth_validity", fallback=DEFAULT_VALIDITY)
+
+    try:
+        mtime = os.path.getmtime(key_path)
+    except OSError as why:
+        raise WebBotAuthError(f"Can't read Web Bot Auth key '{key_path}': {why}") from why
+
+    cache_key = "\0".join([key_path, directory, str(validity), str(mtime)])
+    if cache_key not in _SIGNER_CACHE:
+        try:
+            with open(key_path, "rb") as fh:
+                key_pem = fh.read()
+        except OSError as why:
+            raise WebBotAuthError(f"Can't read Web Bot Auth key '{key_path}': {why}") from why
+        _SIGNER_CACHE[cache_key] = WebBotAuthSigner(
+            key_pem, directory, validity, key_created=int(mtime)
+        )
+    return _SIGNER_CACHE[cache_key]

{redbot-2.4.2 → redbot-2.5.0}/redbot/webui/handlers/run_test.py

@@ -43,7 +43,10 @@ def _validate_req_hdrs(raw: List[str]) -> Tuple[List[Tuple[str, str]], Optional[
         if not name:
             return [], "Request header field name is empty."
         if any(c in _BAD_HEADER_NAME_CHARS or ord(c) < 33 or ord(c) > 126 for c in name):
-            return [], f"Request header field name {name!r} contains invalid characters."
+            return (
+                [],
+                f"Request header field name {name!r} contains invalid characters.",
+            )
         if "\r" in value or "\n" in value:
             return [], f"Request header {name!r} value contains CR or LF."
         headers.append((name, value))

{redbot-2.4.2 → redbot-2.5.0}/redbot/webui/ratelimit.py

@@ -23,7 +23,10 @@ class RateLimiter:
         self.loop = thor.loop
 
     def process(
-        self, webui: RedWebUiProtocol, test_uri: str, error_response: Callable[..., None]
+        self,
+        webui: RedWebUiProtocol,
+        test_uri: str,
+        error_response: Callable[..., None],
     ) -> None:
         """Enforce limits on webui."""
         if not self.running:

{redbot-2.4.2 → redbot-2.5.0/redbot.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redbot
-Version: 2.4.2
+Version: 2.5.0
 Summary: REDbot is lint for HTTP.
 Author-email: Mark Nottingham <mnot@mnot.net>
 License-Expression: MIT
@@ -16,6 +16,8 @@ Classifier: Operating System :: MacOS :: MacOS X
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE.md
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: http-sf>=1.0
 Requires-Dist: httplint>=2026.05.01
 Requires-Dist: importlib_resources
 Requires-Dist: Jinja2>=3.1.2
@@ -113,6 +115,46 @@ or
 > podman run --rm -p 8000:8000 ghcr.io/mnot/redbot
 
 
+## Web Bot Auth
+
+REDbot can authenticate its outgoing requests using [Web Bot Auth](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), which signs requests with an Ed25519 key using [HTTP Message Signatures (RFC 9421)](https://www.rfc-editor.org/rfc/rfc9421). This lets origins verify that requests genuinely come from your REDbot instance. The implementation follows the IETF drafts and is not specific to any one verifier.
+
+Requests are sent unsigned by default. REDbot only attaches a signature when the origin challenges for one -- that is, when it returns a `401`, `403`, or `429` response carrying an `Accept-Signature` header -- and then transparently retries the request signed. This avoids advertising the bot's identity to servers that don't ask for it.
+
+### Generating a key
+
+Create an Ed25519 private key in PEM form:
+
+~~~ bash
+> openssl genpkey -algorithm ed25519 -out web-bot-auth-key.pem
+~~~
+
+Keep this file private and readable by the REDbot process. The matching public key is published automatically (see below); you do not need to extract it yourself.
+
+### Configuring
+
+Set these in `config.txt` (for `redbot_daemon`):
+
+~~~ ini
+web_bot_auth_key = /path/to/web-bot-auth-key.pem
+web_bot_auth_directory = https://your-redbot.example
+~~~
+
+`web_bot_auth_directory` is the HTTPS origin where your public key directory is hosted. When you run `redbot_daemon`, it serves that directory at `/.well-known/http-message-signatures-directory` (a JWKS, self-signed per the spec), so a verifier can fetch your public key. Make sure that path is reachable at the origin you configured.
+
+`web_bot_auth_directory` is optional: if you omit it, REDbot uses the origin of `ui_uri`. Because `ui_uri` defaults to `https://redbot.org/`, **enabling signing requires `ui_uri` to be set to your instance's real public origin** — otherwise you would publish the wrong bot identity. Set `web_bot_auth_directory` explicitly if your key directory lives on a different origin than the UI.
+
+For the command-line tool, pass the equivalent flags (there is no `ui_uri`, so the directory is required):
+
+~~~ bash
+> redbot --web-bot-auth-key web-bot-auth-key.pem --web-bot-auth-directory https://your-redbot.example https://example.com/
+~~~
+
+### Registering with a verifier
+
+To be recognised by a specific verifier, register your directory URL with them according to their process.
+
+
 ## Credits
 
 Icons by [Font Awesome](https://fontawesome.com/). REDbot includes code from [tippy.js](https://atomiks.github.io/tippyjs/) and [prettify.js](https://github.com/google/code-prettify).

{redbot-2.4.2 → redbot-2.5.0}/redbot.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ redbot/i18n.py
 redbot/note.py
 redbot/type.py
 redbot/utils.py
+redbot/webbotauth.py
 redbot.egg-info/PKG-INFO
 redbot.egg-info/SOURCES.txt
 redbot.egg-info/dependency_links.txt

{redbot-2.4.2 → redbot-2.5.0}/redbot.egg-info/requires.txt

@@ -1,3 +1,5 @@
+cryptography>=42.0.0
+http-sf>=1.0
 httplint>=2026.05.01
 importlib_resources
 Jinja2>=3.1.2