regent-httpsig 0.1.0__py3-none-any.whl → 0.1.1__py3-none-any.whl

regent_httpsig/__init__.py

@@ -11,7 +11,7 @@ from regent_httpsig.sfv import parse_signature_agent
 from regent_httpsig.sign import DIRECTORY_MEDIA_TYPE, EgressSigner, generate_seed
 from regent_httpsig.verify import WBA_TAG, HttpsigVerifier, VerifiedSignature
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"
 
 __all__ = [
     "DIRECTORY_MEDIA_TYPE",

regent_httpsig/verify.py

@@ -84,6 +84,31 @@ class VerifiedSignature:
         return out
 
 
+class _KeyidOptionalParams(dict):  # type: ignore[type-arg]
+    """RFC 9421 makes ``keyid`` OPTIONAL, but the upstream verifier reads
+    ``params["keyid"]`` unconditionally. On the AAuth path the key comes from
+    the token's ``cnf.jwk``, so conforming signers (e.g. aauth-signing) omit
+    keyid entirely. Returning None for a missing keyid routes resolution to our
+    StaticKeyResolver default WITHOUT adding the key to the params — iteration
+    is unchanged, so the reconstructed signature base stays byte-identical."""
+
+    def __getitem__(self, key: str) -> Any:
+        if key == "keyid" and key not in self:
+            return None
+        return super().__getitem__(key)
+
+
+class _KeyidOptionalVerifier(HTTPMessageVerifier):
+    def _verify_one(self, *, label: Any, sig_input: Any, signature: Any,
+                    message: Any, max_age: Any) -> Any:
+        if "keyid" not in sig_input.params:
+            sig_input.params = _KeyidOptionalParams(sig_input.params)
+        return super()._verify_one(  # type: ignore[no-untyped-call]
+            label=label, sig_input=sig_input, signature=signature,
+            message=message, max_age=max_age,
+        )
+
+
 def _keys_from_jwks(doc: dict[str, Any]) -> dict[str, Ed25519PublicKey]:
     keys: dict[str, Ed25519PublicKey] = {}
     for jwk in list(doc.get("keys") or [])[:10]:
@@ -311,7 +336,7 @@ class HttpsigVerifier:
             pop_key = load_ed25519_jwk(cnf_jwk)
         except ValueError:
             return None
-        verifier = HTTPMessageVerifier(
+        verifier = _KeyidOptionalVerifier(
             signature_algorithm=ED25519,
             key_resolver=StaticKeyResolver({}, default=pop_key),
             component_resolver_class=DictKeyComponentResolver,

{regent_httpsig-0.1.0.dist-info → regent_httpsig-0.1.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: regent-httpsig
-Version: 0.1.0
+Version: 0.1.1
 Summary: Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth.
 Project-URL: Homepage, https://github.com/regent-protocol/regent-httpsig
 Project-URL: Repository, https://github.com/regent-protocol/regent-httpsig
@@ -101,6 +101,7 @@ and every Web Bot Auth verifier on the internet can now identify your agent.
 | Web Bot Auth A.2.3 — legacy sf-string form (**what OpenAI ships in production**) | ✅ in CI |
 | Sign → verify roundtrip (fresh keys, full pipeline) | ✅ in CI |
 | AAuth identity-mode roundtrip (`aa-agent+jwt` + `cnf.jwk` proof of possession) | ✅ in CI |
+| Signed by [`aauth-signing`](https://github.com/christian-posta/aauth-python-library) (jwt scheme, keyid-less) → verified | ✅² |
 | Tampered request / expired signature / wrong directory key rejected | ✅ in CI |
 
 ¹ The signature bytes printed in the draft's own A.2.2 example do **not** verify over the
@@ -108,6 +109,13 @@ draft's own signature base (the legacy A.2.3 vector and RFC 9421 B.2.6 both do,
 is in the example, not the canonicalization). Ed25519 is deterministic, so our test pins the
 vector re-signed with the same RFC test key over the same byte-exact base — reported upstream.
 
+² Cross-library interop with `aauth-signing`'s jwt scheme: token layer, `cnf.jwk` proof of
+possession and canonicalization all verify. Its signers correctly omit the optional `keyid`
+parameter — which exposed an unconditional `keyid` read in the underlying RFC 9421 library
+that we now handle. One deviation reported upstream to `aauth-signing`: it emits the
+`Signature` byte sequence as base64url, while RFC 8941 requires standard base64. The
+keyid-less shape is pinned in CI.
+
 ## Both dialects, one verifier
 
 - **Web Bot Auth** (`draft-meunier-web-bot-auth-architecture`): key discovery via

{regent_httpsig-0.1.0.dist-info → regent_httpsig-0.1.1.dist-info}/RECORD

@@ -1,4 +1,4 @@
-regent_httpsig/__init__.py,sha256=UZ-RmE0KLmqjD7JV7LnSOnPTc5FPO-5OtQzvsYq9PAs,987
+regent_httpsig/__init__.py,sha256=xtujR5LyjhCFZ9uDuSZJoHTmM9PQglcCr5_AmiSTHNs,987
 regent_httpsig/cli.py,sha256=WUSLQ2WuEX4E85L2C2EgoUfu5cWpj6MRSG1UVNHpzcw,2005
 regent_httpsig/config.py,sha256=xkILlWugaD8Nn4huAgL6RP-C916KxCYRn0YpqCkMOGc,1422
 regent_httpsig/fastapi.py,sha256=YmfrKdeMft2vpuiRlivIEHYC4BIs3ioR7T3t1ZEzcJ4,3707
@@ -6,9 +6,9 @@ regent_httpsig/jwk.py,sha256=h4vgnIgpnyKeWdWpm7g_hEyXZOPVREWn-bD4JN07tT0,1637
 regent_httpsig/netguard.py,sha256=Sqg08mdC94RWvnQLJaH4weZW0nN2VlTJF5wVF8VYGHY,2121
 regent_httpsig/sfv.py,sha256=kcQsBLw9h4h_6D3z2rv0-3_gLZQYC47B9VZi-oS_Vgk,4975
 regent_httpsig/sign.py,sha256=B5ChxFxuuKL0i10bGrgFImzyh8GMjWIqNDECXehBWTA,4397
-regent_httpsig/verify.py,sha256=YVcYWqxUBmqSdWrW8nBCSceT7YApAUjO5J-FIMKBRVM,14256
-regent_httpsig-0.1.0.dist-info/METADATA,sha256=4v_RgOudkaT3ui9921kZhM8R5fGfJbLl5e3e1pDBTh0,7871
-regent_httpsig-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-regent_httpsig-0.1.0.dist-info/entry_points.txt,sha256=SgZdmc27V14IAmwOjbBoCYLsbrALaqdTUHNHLbil2dU,59
-regent_httpsig-0.1.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-regent_httpsig-0.1.0.dist-info/RECORD,,
+regent_httpsig/verify.py,sha256=lGmGqlUKXtMlEDwoAanUZcz98XpPnY6rDe7CfuMXIiQ,15434
+regent_httpsig-0.1.1.dist-info/METADATA,sha256=BePwZKhmLOt-Obf4Y3H-I1VWvXUM4juOiOI5w6tvki4,8488
+regent_httpsig-0.1.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+regent_httpsig-0.1.1.dist-info/entry_points.txt,sha256=SgZdmc27V14IAmwOjbBoCYLsbrALaqdTUHNHLbil2dU,59
+regent_httpsig-0.1.1.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+regent_httpsig-0.1.1.dist-info/RECORD,,