redbot 2.7.0__tar.gz → 2.7.1__tar.gz

{redbot-2.7.0/redbot.egg-info → redbot-2.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redbot
-Version: 2.7.0
+Version: 2.7.1
 Summary: REDbot is lint for HTTP.
 Author-email: Mark Nottingham <mnot@mnot.net>
 License-Expression: MIT
@@ -18,12 +18,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.md
 Requires-Dist: cryptography>=42.0.0
 Requires-Dist: http-sf>=1.4.0
-Requires-Dist: httplint>=2026.10.1
+Requires-Dist: httplint>=2026.10.3
 Requires-Dist: Jinja2>=3.1.2
 Requires-Dist: markdown>=3.4.4
 Requires-Dist: MarkupSafe>=2.1.3
 Requires-Dist: netaddr>=1.2.1
-Requires-Dist: thor>=0.16.0
+Requires-Dist: thor>=0.16.1
 Provides-Extra: systemd
 Requires-Dist: cysystemd; extra == "systemd"
 Provides-Extra: dev

{redbot-2.7.0 → redbot-2.7.1}/pyproject.toml

@@ -22,12 +22,12 @@ license-files = ["LICENSE.md"]
 dependencies = [
     "cryptography >= 42.0.0",
     "http-sf >= 1.4.0",
-    "httplint >= 2026.10.1",
+    "httplint >= 2026.10.3",
     "Jinja2 >= 3.1.2",
     "markdown >= 3.4.4",
     "MarkupSafe >= 2.1.3",
     "netaddr >= 1.2.1",
-    "thor >= 0.16.0",
+    "thor >= 0.16.1",
 ]
 
 [project.urls]

{redbot-2.7.0 → redbot-2.7.1}/redbot/__init__.py

@@ -2,7 +2,7 @@
 This is the Resource Expert Droid.
 """
 
-__version__ = "2.7.0"
+__version__ = "2.7.1"
 __author__ = "Mark Nottingham <mnot@mnot.net>"
 __copyright__ = """\
 Copyright (c) 2008- Mark Nottingham

{redbot-2.7.0 → redbot-2.7.1}/redbot/daemon.py

@@ -453,28 +453,12 @@ in standalone server mode. Details follow.
             (b"Content-Type", DIRECTORY_CONTENT_TYPE.encode("ascii")),
             (b"Cache-Control", b"max-age=%d" % DIRECTORY_MAX_AGE),
         ]
-        authority = self.request_authority()
-        if authority:
-            headers += signer.sign_directory(authority)
+        headers += signer.sign_directory()
         self.exchange.response_start(b"200", b"OK", headers)
         self.exchange.response_body(body)
         self.exchange.response_done([])
         return None
 
-    def request_authority(self) -> str:
-        "The authority (Host) of the incoming request, for signing."
-        for name, value in self.req_hdrs:
-            if name.lower() == b"host":
-                host = value.decode("ascii", "replace").strip().lower()
-                # Drop a default port so the signed @authority matches what a
-                # verifier normalizes to (RFC 9421 derives @authority this way).
-                for suffix in (":443", ":80"):
-                    if host.endswith(suffix):
-                        host = host[: -len(suffix)]
-                        break
-                return host
-        return ""
-
     def not_found(self, path: bytes) -> None:
         headers = []
         headers.append((b"Content-Type", b"text/plain"))

{redbot-2.7.0 → redbot-2.7.1}/redbot/formatter/html.py

@@ -89,7 +89,7 @@ class SingleEntryHtmlFormatter(BaseHtmlFormatter):
     def finish_output(self) -> None:
         self.final_status()
         media_type = self.resource.response.headers.parsed.get("content-type", [""])[0]
-        if self.resource.response.complete or self.resource.nonfinal_responses:
+        if self.resource.has_response or self.resource.nonfinal_responses:
             validator_link = self.validators.get(media_type, None)
             if validator_link and self.resource.response.complete:
                 validator_link = validator_link % e_query_arg(self.resource.request.uri or "")
@@ -355,6 +355,7 @@ class TableHtmlFormatter(BaseHtmlFormatter):
                     **{
                         "droid_lists": self.make_droid_lists(self.resource),
                         "problems": self.problems,
+                        "show_har": self.resource.response.complete,
                         "levels": levels,
                         "is_saved": is_saved,
                         "save_mtime": save_mtime,

{redbot-2.7.0 → redbot-2.7.1}/redbot/formatter/templates/response_finish.html

@@ -17,7 +17,7 @@
 
         {% if resource.fetch_error %}
         <p class='error'>
-            {{ resource.fetch_error.desc }}
+            {{ resource.fetch_error.desc }}{% if resource.fetch_error.detail %} ({{ resource.fetch_error.detail }}){% endif %}
         </p>
         {% endif %}
 
@@ -38,6 +38,7 @@
             <span class='option' title='{{ _("How large the response headers are, including the status line") }}'>{{
                 _("response headers") }}: {{ resource.response_header_length|f_num }} {{ _("bytes") }}</span>
 
+            {% if resource.response.complete %}
             <span class='option' title='{{ _("How large the response content is") }}'>{{ _("content") }}: {{
                 resource.response.content_length|f_num }} {{ _("bytes") }}</span>
 
@@ -46,6 +47,7 @@
                 _("transfer overhead") }}: {{ (resource.response.transfer_length -
                 resource.response.content_length)|f_num }} {{ _("bytes") }}</span>
             {%- endif %}
+            {% endif %}
 
             <br />
 
@@ -53,7 +55,7 @@
                 <a href='#' id='body_view' accesskey='b'>{{ _("view content") }}</a>
             </div>
 
-            {% if is_resource %}
+            {% if is_resource and resource.response.complete %}
             <div class='option'>
                 {{ har_link }}
             </div>

{redbot-2.7.0 → redbot-2.7.1}/redbot/formatter/templates/response_multi_finish.html

@@ -27,6 +27,15 @@
 {% endif %}
 {%- endmacro %}
 
+{% macro notes_cell(resource) %}
+<td>
+    {% for problem in resource.response.notes if problem.level in [levels.WARN, levels.BAD] %}
+    <span class='prob_num'>{{ problem|index_problem }}<span class='hidden'><span class='tip'>{{ problem.detail
+                }}</span></span></span>
+    {% endfor %}
+</td>
+{%- endmacro %}
+
 <table id='summary'>
     {% for heading, droids in droid_lists %}
     {% if heading != "" %}
@@ -70,20 +79,21 @@
         <td>{{ yes_no(resource.gzip_support) }}</td>
         {% endif %}
         <td>{{ yes_no(resource.partial_support) }}</td>
-        <td>
-            {% for problem in resource.response.notes if problem.level in [levels.WARN, levels.BAD] %}
-            <span class='prob_num'>{{ problem|index_problem }}<span class='hidden'><span class='tip'>{{ problem.detail
-                        }}</span></span></span>
-            {% endfor %}
-        </td>
+        {{ notes_cell(resource) }}
         {% else %}
-        <td colspan="11">
+        {% if resource.has_response %}
+        <td>{{ resource.response.status_code_str }}</td>
+        {% endif %}
+        <td colspan="{{ 9 if resource.has_response else 11 }}">
             {% if resource.fetch_error == None %}
             {{ _("response incomplete") }}
             {% else %}
             {{ resource.fetch_error.desc or _("unknown problem") }}
             {% endif %}
         </td>
+        {% if resource.has_response %}
+        {{ notes_cell(resource) }}
+        {% endif %}
         {% endif %}
     </tr>
     {% endfor %}
@@ -91,9 +101,11 @@
 </table>
 
 <div class="options">
+    {% if show_har %}
     <div class='option'>
         {{ har_link }}
     </div>
+    {% endif %}
     {% if not is_saved %}
     {% if allow_save %}
     <div class='option' title='{{ _("Save these results for future reference") }}'>

{redbot-2.7.0 → redbot-2.7.1}/redbot/formatter/templates/response_start.html

@@ -63,7 +63,7 @@
 
 <body class="{{ extra_body_class }}">
 
-    {{ links.save_form(test_id, descend) | safe }}
+    {% if test_id %}{{ links.save_form(test_id, descend) | safe }}{% endif %}
 
     <div id="request">
         <h1><a href="{{ links.home_link() }}"><span class="hilight"><abbr title="Resource Expert Droid">RED</abbr></span>bot</a>{{ extra_title

{redbot-2.7.0 → redbot-2.7.1}/redbot/formatter/text.py

@@ -86,30 +86,30 @@ class BaseTextFormatter(Formatter):
 
     def finish_output(self) -> None:
         "Fill in the template with RED's results."
-        if self.resource.response.complete or self.resource.nonfinal_responses:
+        response = self.resource.response
+        if self.resource.has_response or self.resource.nonfinal_responses:
             if self.resource.nonfinal_responses:
                 self.output(
                     NL.join([self.format_headers(r) for r in self.resource.nonfinal_responses])
                     + NL
                     + NL
                 )
-            if self.resource.response.complete:
-                self.output(self.format_headers(self.resource.response) + NL + NL)
-            elif isinstance(self.resource.fetch_error, httperr.HttpError):
-                self.output(
-                    self.error_template % self._format_fetch_error(self.resource.fetch_error)
-                )
+            if self.resource.has_response:
+                self.output(self.format_headers(response) + NL + NL)
+            if not response.complete:
+                self.output_fetch_error(self.resource)
 
             self.output(self.format_recommendations(self.resource) + NL)
         else:
-            if self.resource.fetch_error is None:
-                pass
-            elif isinstance(self.resource.fetch_error, httperr.HttpError):
-                self.output(
-                    self.error_template % self._format_fetch_error(self.resource.fetch_error)
-                )
-            else:
-                raise AssertionError("Unknown incomplete response error.")
+            self.output_fetch_error(self.resource)
+
+    def output_fetch_error(self, resource: HttpResource) -> None:
+        "Output the error for a resource whose fetch failed, if there is one."
+        if resource.fetch_error is None:
+            return
+        if not isinstance(resource.fetch_error, httperr.HttpError):
+            raise AssertionError("Unknown incomplete response error.")
+        self.output(self.error_template % self._format_fetch_error(resource.fetch_error))
 
     @staticmethod
     def _format_fetch_error(error: httperr.HttpError) -> str:
@@ -227,7 +227,12 @@ class TextListFormatter(BaseTextFormatter):
                 subresources.sort(key=operator.attrgetter("request.uri"))
                 for subresource in subresources:
                     self.output(self.format_uri(subresource) + NL + NL)
-                    self.output(self.format_headers(subresource.response) + NL + NL)
+                    if not subresource.has_response:  # no response to show
+                        self.output_fetch_error(subresource)
+                    else:
+                        self.output(self.format_headers(subresource.response) + NL + NL)
+                        if not subresource.response.complete:
+                            self.output_fetch_error(subresource)
                     self.output(self.format_recommendations(subresource) + NL + NL)
 
     def format_uri(self, resource: HttpResource) -> str:

{redbot-2.7.0 → redbot-2.7.1}/redbot/resource/__init__.py

@@ -15,7 +15,7 @@ from typing import Dict, List, Optional, Set, Tuple, Union
 from urllib.parse import urljoin
 
 import thor
-from thor.http.error import UrlError
+from thor.http.error import HttpError, UrlError
 from thor.http.uri import parse_uri
 
 from redbot.resource import link_parse
@@ -59,7 +59,7 @@ class HttpResource(RedFetcher):
     if descend is true, the response will be parsed for links and HttpResources started for each
     link, enumerated in .linked. Linked resources don't run active checks.
 
-    Emits "check_done" when everything has finished.
+    Emits "check_done" once, when everything has finished.
     """
 
     check_name = "default"
@@ -86,7 +86,9 @@ class HttpResource(RedFetcher):
         self.links: Dict[str, Set[str]] = {}
         self.link_count: int = 0
         self.linked: List[Tuple[HttpResource, str]] = []  # linked HttpResources
-        self._link_parser = link_parse.HTMLLinkParser(self.response, [self.process_link])
+        self._link_parser = link_parse.HTMLLinkParser(
+            self.response, [self.process_link], err=self._link_error
+        )
         if self.descend or config.getboolean("content_links", False):
             self.response.decoded.processors.append(self._link_parser.feed_bytes)
 
@@ -95,8 +97,11 @@ class HttpResource(RedFetcher):
         Response is available; perform subordinate requests (e.g., conneg check).
         """
         if self.response.complete and self.active_checks_enabled:
-            for active_check in list(self.subreqs.values()):
-                self.add_check(active_check)
+            # Register every check before starting any: one that finishes synchronously mustn't
+            # empty the task map while others are still to be started.
+            active = list(self.subreqs.values())
+            self.add_check(*active)
+            for active_check in active:
                 active_check.check()
         else:
             self.finish_check()
@@ -140,7 +145,8 @@ class HttpResource(RedFetcher):
                 raise KeyError(f"* Can't find {resource} in task map: {self._task_map}") from None
         tasks_left = len(self._task_map)
         #        self.emit("debug", "%s checks remaining: %i" % (repr(self), tasks_left))
-        if tasks_left == 0:
+        # Links that fail immediately mustn't complete us while we're still reading the response.
+        if tasks_left == 0 and self.fetch_done and not self.check_done:
             self.check_done = True
             self.emit("check_done")
 
@@ -167,7 +173,12 @@ class HttpResource(RedFetcher):
         if self.descend and tag not in ["a"] and link not in self.links[tag]:
             linked = HttpResource(self.config, active_checks_enabled=False)
             credentials, other_headers = split_credentials(self.request.headers.text)
-            linked.set_request(urljoin(base, link), headers=other_headers)
+            uri: Optional[str]
+            try:
+                uri = urljoin(base, link)
+            except ValueError:
+                uri = None
+            linked.set_request(uri if uri is not None else link, headers=other_headers)
             # Compare the normalised URIs, not the link text: normalisation can change the host.
             # Credentials stay off unless both origins are known and equal.
             linked_origin = origin_of(linked.request.uri)
@@ -177,11 +188,33 @@ class HttpResource(RedFetcher):
                 )
             self.linked.append((linked, tag))
             self.add_check(linked)
-            linked.check()
+            if uri is None:  # can't be resolved; list it as failed and carry on
+                self._fail_link(linked, UrlError("link could not be resolved"))
+            else:
+                try:
+                    linked.check()
+                except Exception as why:  # pylint: disable=broad-except
+                    self._fail_link(linked, HttpError(str(why)))
         self.links[tag].add(link)
         if not self.response.base_uri:
             self.response.base_uri = base
 
+    def _fail_link(self, linked: "HttpResource", error: HttpError) -> None:
+        "Record why a linked resource couldn't be checked, and complete it."
+        linked.fetch_error = linked.fetch_error or error
+        linked.stop()
+        if linked in self._task_map:  # stop() didn't complete it
+            self.finish_check(linked)
+        try:  # after cleanup, so a failing listener can't undo it
+            uri = (linked.request.uri or "")[:200]
+            self.emit("debug", f"checking link {uri} failed: {error!r}")
+        except Exception:  # pylint: disable=broad-except
+            pass
+
+    def _link_error(self, message: str) -> None:
+        "Report a problem parsing or handling links."
+        self.emit("debug", f"link parsing: {message}")
+
     def stop(self) -> None:
         "Stop the resource and any sub-resources."
         for task in list(self._task_map):

{redbot-2.7.0 → redbot-2.7.1}/redbot/resource/fetch.py

@@ -116,6 +116,11 @@ class RedFetcher(thor.events.EventEmitter):
             out.append("fetch_done")
         return f"<{', '.join(out)} at {id(self):#x}>"
 
+    @property
+    def has_response(self) -> bool:
+        "Whether a status line arrived, so there are headers to show even if the body failed."
+        return self.response.status_code is not None
+
     def preflight(self) -> bool:
         """
         Check to see if we should bother running. Return True
@@ -189,6 +194,13 @@ class RedFetcher(thor.events.EventEmitter):
         "Start an exchange for the current request, optionally adding extra headers."
         assert self.request.method, "method not set in _send_request"
         assert self.request.uri, "uri not set in _send_request"
+        try:
+            wire_uri = self.request.uri.encode("ascii")
+        except UnicodeEncodeError:
+            # e.g., httplint leaves a non-ASCII password in the URI unencoded
+            self.fetch_error = httperr.UrlError("URI contains non-ASCII characters")
+            self._fetch_done()
+            return
         self.exchange = self.client.exchange()
         self.exchange.on("response_nonfinal", self._response_nonfinal)
         self.exchange.once("response_start", self._response_start)
@@ -210,7 +222,7 @@ class RedFetcher(thor.events.EventEmitter):
         self.request.start_time = time.time()
         self.exchange.request_start(
             self.request.method.encode("ascii"),
-            self.request.uri.encode("ascii"),
+            wire_uri,
             req_hdrs,
         )
         if not self.fetch_done:  # the request could have immediately failed.
@@ -292,6 +304,7 @@ class RedFetcher(thor.events.EventEmitter):
         assert self.exchange.res_version, "exchange.res_version not set in _response_start"
         self.response.process_response_topline(self.exchange.res_version, status, phrase)
         self.response.process_headers(res_headers)
+        self.response_header_length = self.exchange.input_header_length
         self.emit("response_headers_available")
 
     def _response_body(self, chunk: bytes) -> None:
@@ -341,10 +354,12 @@ class RedFetcher(thor.events.EventEmitter):
                 self.response.notes.add("body", EXTRA_DATA, sample=err_sample)
         elif isinstance(error, httperr.ChunkError):
             self.response.notes.add("field-transfer-encoding", BAD_CHUNK, chunk_sample=err_sample)
+            self.fetch_error = error  # thor stops the response here, so it never completes
         elif isinstance(error, httperr.HeaderSpaceError) and error.detail:
-            subject = f"field-{error.detail.lower().strip()}"
-            self.response.notes.add(subject, HEADER_NAME_SPACE, header_name=error.detail)
-            return
+            subject = f"field-{err_sample.lower().strip()}"
+            self.response.notes.add(subject, HEADER_NAME_SPACE, header_name=err_sample)
+            # thor sends nothing after an error, so the response never completes.
+            self.fetch_error = error
         else:
             self.fetch_error = error
         self._fetch_done()

{redbot-2.7.0 → redbot-2.7.1}/redbot/resource/link_parse.py

@@ -7,15 +7,30 @@ Parse links from a stream of HTML data.
 import codecs
 from html.parser import HTMLParser
 from typing import Any, Callable, Dict, List, Optional, Tuple
+from urllib.parse import urljoin, urlsplit
 
-from httplint.field.utils import split_string, unquote_string
+from httplint.charset import is_text_encoding, whatwg_encoding
+from httplint.field.utils import split_params, unquote_string
 from httplint.message import HttpMessageLinter
-from httplint.syntax import rfc9110
 
 from redbot.utils import decode_text
 
 DEFAULT_ENCODING = "utf-8"
 MAX_FEED_BYTES = 2 * 1024 * 1024
+# A <base> inside these isn't the document's base (noscript: as when scripting is enabled).
+INERT_TAGS = ("template", "svg", "math", "noscript")
+
+# Python codecs that decode bytes to text but that a <meta> must not select: UTF-7 and
+# UTF-16/32 (HTML treats a UTF-16 <meta> as UTF-8), and ones that aren't character encodings.
+NOT_META_CHARSETS = (
+    "utf_7",
+    "utf_16",
+    "utf_32",
+    "unicode_escape",
+    "raw_unicode_escape",
+    "idna",
+    "punycode",
+)
 
 
 class HTMLLinkParser(HTMLParser):
@@ -52,7 +67,7 @@ class HTMLLinkParser(HTMLParser):
         self,
         message: HttpMessageLinter,
         link_procs: List[Callable[[str, str, str, str], None]],
-        err: Optional[Callable[[str], int]] = None,
+        err: Optional[Callable[[str], None]] = None,
     ) -> None:
         self.message = message
         self.link_procs = link_procs
@@ -61,6 +76,9 @@ class HTMLLinkParser(HTMLParser):
         self.last_err_pos: int = 0
         self.ok = True
         self.bytes_fed = 0
+        self.base_seen = False
+        self.inert_depth = {tag: 0 for tag in INERT_TAGS}
+        self.decode_as: Optional[str] = None
         HTMLParser.__init__(self)
 
     def __getstate__(self) -> Dict[str, Any]:
@@ -73,7 +91,7 @@ class HTMLLinkParser(HTMLParser):
             if self.bytes_fed > MAX_FEED_BYTES:
                 self.ok = False
                 return
-            encoding = self.message.character_encoding or DEFAULT_ENCODING
+            encoding = self.decode_as or self.message.character_encoding or DEFAULT_ENCODING
             decoded = decode_text(bchunk, encoding, "ignore")
             self.feed(decoded)
 
@@ -106,7 +124,13 @@ class HTMLLinkParser(HTMLParser):
                     for proc in self.link_procs:
                         proc(self.message.base_uri, target, tag, title)
         elif tag == "base":
-            self.message.base_uri = dict(attrs).get("href", self.message.base_uri) or ""
+            attr_d = dict(attrs)
+            inert = any(self.inert_depth.values())
+            if "href" in attr_d and not self.base_seen and not inert:  # first <base href> counts
+                self.base_seen = True
+                self.message.base_uri = resolve_base(self.message.base_uri, attr_d["href"] or "")
+        elif tag in self.inert_depth:
+            self.inert_depth[tag] += 1
         elif tag == "meta":
             attr_d = dict(attrs)
             if (attr_d.get("http-equiv", "") or "").lower() != "content-type":
@@ -119,18 +143,36 @@ class HTMLLinkParser(HTMLParser):
                     media_type, params = ct, ""
                 media_type = media_type.lower()
                 param_dict: Dict[str, Optional[str]] = {}
-                for param in split_string(params, rfc9110.parameter, r"\s*;\s*"):
+                for param in split_params(params):
                     try:
                         attr, val = param.split("=", 1)
                         param_dict[attr.lower()] = unquote_string(val)
                     except ValueError:
                         param_dict[param.lower()] = None
-                enc = param_dict.get("charset", self.message.character_encoding) or DEFAULT_ENCODING
-                try:
-                    codecs.lookup(enc)
-                    self.message.character_encoding = enc
-                except LookupError:
-                    pass
+                self._set_meta_charset(param_dict.get("charset"))
+
+    def _set_meta_charset(self, label: Optional[str]) -> None:
+        """
+        Apply a <meta> charset. A label that the Encoding Standard and Python both know is
+        recorded on the message, as for the header. A Python-only text encoding (`latin-1`,
+        `mac-roman`) is only used to decode later chunks, so the message never claims it.
+        Anything else is ignored.
+        """
+        if not label or not is_text_encoding(label):
+            return
+        encoding = whatwg_encoding(label)
+        if encoding == "replacement":
+            return
+        if encoding:
+            self.message.whatwg_encoding = encoding
+            self.message.character_encoding = label
+            self.decode_as = None
+        elif not codecs.lookup(label).name.replace("-", "_").startswith(NOT_META_CHARSETS):
+            self.decode_as = label
+
+    def handle_endtag(self, tag: str) -> None:
+        if self.inert_depth.get(tag):
+            self.inert_depth[tag] -= 1
 
     def error(self, message: str) -> None:
         self.errors += 1
@@ -145,5 +187,19 @@ class HTMLLinkParser(HTMLParser):
             self.err(message)
 
 
+def resolve_base(page_uri: str, href: str) -> str:
+    """
+    Resolve a <base href> against the page's URI. As in the HTML spec, an unparseable href or a
+    data: or javascript: URI leaves the page URI as the base (Chromium uses about:blank instead).
+    """
+    try:
+        base = urljoin(page_uri, href.strip(" \t\n\f\r"))
+        if urlsplit(base).scheme.lower() in ("data", "javascript"):
+            return page_uri
+    except ValueError:
+        return page_uri
+    return base
+
+
 class BadErrorIReallyMeanIt(Exception):
     """See http://bugs.python.org/issue8885 for why this is necessary."""

{redbot-2.7.0 → redbot-2.7.1}/redbot/webbotauth.py

@@ -87,6 +87,14 @@ class WebBotAuthSigner:
             raise WebBotAuthError("Web Bot Auth key must be an Ed25519 private key.")
         self._key = key
         self.directory = directory.strip().strip('"')
+        # Verifiers derive @authority from the directory URL they fetched. A
+        # scheme-less directory is taken as https.
+        try:
+            self.directory_authority = self.authority(
+                self.directory if "://" in self.directory else f"https://{self.directory}"
+            )
+        except ValueError as why:
+            raise WebBotAuthError(f"Invalid Web Bot Auth directory '{directory}'.") from why
         self.validity = validity
         self.key_created = key_created
 
@@ -121,15 +129,16 @@ class WebBotAuthSigner:
 
     def _build_signature(
         self,
-        components: List[Tuple[str, str]],
+        components: List[Tuple[http_sf.types.ItemType, str]],
         tag: str,
         validity: int,
     ) -> Tuple[str, str]:
         """
         Construct the RFC 9421 signature base over ``components`` (each an
-        ordered (component-name, component-value) pair), sign it, and return the
-        Signature-Input and Signature dictionary-member values for SIG_LABEL.
-        ``validity`` is the signature lifetime in seconds.
+        ordered (component-identifier, component-value) pair; an identifier is a
+        structured-field item, so it can carry parameters such as ``req``), sign
+        it, and return the Signature-Input and Signature dictionary-member values
+        for SIG_LABEL. ``validity`` is the signature lifetime in seconds.
 
         Structured-field values are serialized with ``http_sf`` so the
         @signature-params line in the base and the Signature-Input header are
@@ -144,10 +153,10 @@ class WebBotAuthSigner:
             "nonce": base64.b64encode(secrets.token_bytes(32)).decode("ascii"),
             "tag": tag,
         }
-        covered: List[http_sf.types.ItemType] = [name for name, _ in components]
+        covered = [identifier for identifier, _ in components]
         inner_list: http_sf.types.InnerListType = (covered, params)
 
-        base_lines = [f"{http_sf.ser(name)}: {value}" for name, value in components]
+        base_lines = [f"{http_sf.ser(identifier)}: {value}" for identifier, value in components]
         base_lines.append(f'{http_sf.ser("@signature-params")}: {http_sf.ser([inner_list])}')
         signature = self._key.sign("\n".join(base_lines).encode("utf-8"))
 
@@ -157,7 +166,10 @@ class WebBotAuthSigner:
         "Return the Web Bot Auth headers to add to a request for ``uri``."
         agent_field = http_sf.ser(self.directory)  # Signature-Agent value (an sf-string)
         sig_input, sig = self._build_signature(
-            [("@authority", self.authority(uri)), ("signature-agent", agent_field)],
+            [
+                (("@authority", {}), self.authority(uri)),
+                (("signature-agent", {}), agent_field),
+            ],
             REQUEST_TAG,
             self.validity,
         )
@@ -167,10 +179,13 @@ class WebBotAuthSigner:
             (b"Signature", sig.encode("ascii")),
         ]
 
-    def sign_directory(self, authority: str) -> List[Tuple[bytes, bytes]]:
-        "Return the signature headers for a directory response served at ``authority``."
+    def sign_directory(self) -> List[Tuple[bytes, bytes]]:
+        "Return the signature headers for the directory response."
+        # Directory draft section 5.2: @authority must carry req (RFC 9421 section 2.4).
         sig_input, sig = self._build_signature(
-            [("@authority", authority)], DIRECTORY_TAG, DIRECTORY_VALIDITY
+            [(("@authority", {"req": True}), self.directory_authority)],
+            DIRECTORY_TAG,
+            DIRECTORY_VALIDITY,
         )
         return [
             (b"Signature-Input", sig_input.encode("ascii")),