regent-httpsig 0.1.0__tar.gz → 0.1.1__tar.gz

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.1
+
+- AAuth: tolerate absent `keyid` (RFC 9421 makes it optional; the key comes from
+  the token's `cnf.jwk`). Exposed by cross-library interop with
+  christian-posta/aauth-signing, whose signers correctly omit it; that signer's
+  exact keyid-less shape is now pinned in CI.
+
 ## 0.1.0
 
 Initial release, extracted from Regent Protocol's production marketplace

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: regent-httpsig
-Version: 0.1.0
+Version: 0.1.1
 Summary: Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth.
 Project-URL: Homepage, https://github.com/regent-protocol/regent-httpsig
 Project-URL: Repository, https://github.com/regent-protocol/regent-httpsig
@@ -101,6 +101,7 @@ and every Web Bot Auth verifier on the internet can now identify your agent.
 | Web Bot Auth A.2.3 — legacy sf-string form (**what OpenAI ships in production**) | ✅ in CI |
 | Sign → verify roundtrip (fresh keys, full pipeline) | ✅ in CI |
 | AAuth identity-mode roundtrip (`aa-agent+jwt` + `cnf.jwk` proof of possession) | ✅ in CI |
+| Signed by [`aauth-signing`](https://github.com/christian-posta/aauth-python-library) (jwt scheme, keyid-less) → verified | ✅² |
 | Tampered request / expired signature / wrong directory key rejected | ✅ in CI |
 
 ¹ The signature bytes printed in the draft's own A.2.2 example do **not** verify over the
@@ -108,6 +109,13 @@ draft's own signature base (the legacy A.2.3 vector and RFC 9421 B.2.6 both do,
 is in the example, not the canonicalization). Ed25519 is deterministic, so our test pins the
 vector re-signed with the same RFC test key over the same byte-exact base — reported upstream.
 
+² Cross-library interop with `aauth-signing`'s jwt scheme: token layer, `cnf.jwk` proof of
+possession and canonicalization all verify. Its signers correctly omit the optional `keyid`
+parameter — which exposed an unconditional `keyid` read in the underlying RFC 9421 library
+that we now handle. One deviation reported upstream to `aauth-signing`: it emits the
+`Signature` byte sequence as base64url, while RFC 8941 requires standard base64. The
+keyid-less shape is pinned in CI.
+
 ## Both dialects, one verifier
 
 - **Web Bot Auth** (`draft-meunier-web-bot-auth-architecture`): key discovery via

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/README.md

@@ -71,6 +71,7 @@ and every Web Bot Auth verifier on the internet can now identify your agent.
 | Web Bot Auth A.2.3 — legacy sf-string form (**what OpenAI ships in production**) | ✅ in CI |
 | Sign → verify roundtrip (fresh keys, full pipeline) | ✅ in CI |
 | AAuth identity-mode roundtrip (`aa-agent+jwt` + `cnf.jwk` proof of possession) | ✅ in CI |
+| Signed by [`aauth-signing`](https://github.com/christian-posta/aauth-python-library) (jwt scheme, keyid-less) → verified | ✅² |
 | Tampered request / expired signature / wrong directory key rejected | ✅ in CI |
 
 ¹ The signature bytes printed in the draft's own A.2.2 example do **not** verify over the
@@ -78,6 +79,13 @@ draft's own signature base (the legacy A.2.3 vector and RFC 9421 B.2.6 both do,
 is in the example, not the canonicalization). Ed25519 is deterministic, so our test pins the
 vector re-signed with the same RFC test key over the same byte-exact base — reported upstream.
 
+² Cross-library interop with `aauth-signing`'s jwt scheme: token layer, `cnf.jwk` proof of
+possession and canonicalization all verify. Its signers correctly omit the optional `keyid`
+parameter — which exposed an unconditional `keyid` read in the underlying RFC 9421 library
+that we now handle. One deviation reported upstream to `aauth-signing`: it emits the
+`Signature` byte sequence as base64url, while RFC 8941 requires standard base64. The
+keyid-less shape is pinned in CI.
+
 ## Both dialects, one verifier
 
 - **Web Bot Auth** (`draft-meunier-web-bot-auth-architecture`): key discovery via

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "regent-httpsig"
-version = "0.1.0"
+version = "0.1.1"
 description = "Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth."
 readme = "README.md"
 license = "Apache-2.0"

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/src/regent_httpsig/__init__.py

@@ -11,7 +11,7 @@ from regent_httpsig.sfv import parse_signature_agent
 from regent_httpsig.sign import DIRECTORY_MEDIA_TYPE, EgressSigner, generate_seed
 from regent_httpsig.verify import WBA_TAG, HttpsigVerifier, VerifiedSignature
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"
 
 __all__ = [
     "DIRECTORY_MEDIA_TYPE",

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/src/regent_httpsig/verify.py

@@ -84,6 +84,31 @@ class VerifiedSignature:
         return out
 
 
+class _KeyidOptionalParams(dict):  # type: ignore[type-arg]
+    """RFC 9421 makes ``keyid`` OPTIONAL, but the upstream verifier reads
+    ``params["keyid"]`` unconditionally. On the AAuth path the key comes from
+    the token's ``cnf.jwk``, so conforming signers (e.g. aauth-signing) omit
+    keyid entirely. Returning None for a missing keyid routes resolution to our
+    StaticKeyResolver default WITHOUT adding the key to the params — iteration
+    is unchanged, so the reconstructed signature base stays byte-identical."""
+
+    def __getitem__(self, key: str) -> Any:
+        if key == "keyid" and key not in self:
+            return None
+        return super().__getitem__(key)
+
+
+class _KeyidOptionalVerifier(HTTPMessageVerifier):
+    def _verify_one(self, *, label: Any, sig_input: Any, signature: Any,
+                    message: Any, max_age: Any) -> Any:
+        if "keyid" not in sig_input.params:
+            sig_input.params = _KeyidOptionalParams(sig_input.params)
+        return super()._verify_one(  # type: ignore[no-untyped-call]
+            label=label, sig_input=sig_input, signature=signature,
+            message=message, max_age=max_age,
+        )
+
+
 def _keys_from_jwks(doc: dict[str, Any]) -> dict[str, Ed25519PublicKey]:
     keys: dict[str, Ed25519PublicKey] = {}
     for jwk in list(doc.get("keys") or [])[:10]:
@@ -311,7 +336,7 @@ class HttpsigVerifier:
             pop_key = load_ed25519_jwk(cnf_jwk)
         except ValueError:
             return None
-        verifier = HTTPMessageVerifier(
+        verifier = _KeyidOptionalVerifier(
             signature_algorithm=ED25519,
             key_resolver=StaticKeyResolver({}, default=pop_key),
             component_resolver_class=DictKeyComponentResolver,

{regent_httpsig-0.1.0 → regent_httpsig-0.1.1}/tests/test_verifier.py

@@ -142,6 +142,61 @@ async def test_aauth_expired_token_rejected(monkeypatch: pytest.MonkeyPatch) ->
     assert await verifier.verify("POST", url, headers) is None
 
 
+async def test_aauth_without_keyid_param(monkeypatch: pytest.MonkeyPatch) -> None:
+    """RFC 9421 makes keyid OPTIONAL; on the AAuth path the key comes from the
+    token's cnf.jwk, so conforming signers (e.g. christian-posta/aauth-signing)
+    omit it. Pins the interop shape: signature built WITHOUT keyid must verify."""
+    import base64
+
+    agent_priv = Ed25519PrivateKey.generate()
+    agent_jwk = {"kty": "OKP", "crv": "Ed25519",
+                 "x": b64url(agent_priv.public_key().public_bytes_raw())}
+    issuer_priv = Ed25519PrivateKey.generate()
+    issuer_jwk = {
+        "kty": "OKP", "crv": "Ed25519", "kid": "iss-1", "alg": "EdDSA",
+        "x": b64url(issuer_priv.public_key().public_bytes_raw()),
+    }
+    now = int(time.time())
+    token = pyjwt.encode(
+        {"iss": "https://issuer.example", "sub": "agent-42", "iat": now,
+         "exp": now + 600, "dwk": "aauth-agent.json", "cnf": {"jwk": agent_jwk}},
+        issuer_priv, algorithm="EdDSA",
+        headers={"typ": "aa-agent+jwt", "kid": "iss-1"},
+    )
+
+    # Build the signature exactly the way aauth-signing does: covered components
+    # @method/@authority/@path/signature-key, created only — NO keyid param.
+    sig_key_header = f'sig=jwt;jwt="{token}"'
+    params = ('("@method" "@authority" "@path" "signature-key")'
+              f";created={now}")
+    base = "\n".join([
+        '"@method": POST',
+        '"@authority": api.example',
+        '"@path": /v1/orders',
+        f'"signature-key": {sig_key_header}',
+        f'"@signature-params": {params}',
+    ]).encode()
+    signature = base64.b64encode(agent_priv.sign(base)).decode()
+    headers = {
+        "Host": "api.example",
+        "Signature-Key": sig_key_header,
+        "Signature-Input": f"sig={params}",
+        "Signature": f"sig=:{signature}:",
+    }
+
+    verifier = HttpsigVerifier()
+    monkeypatch.setattr(
+        verifier, "_fetch_json",
+        _mock_fetch({
+            "https://issuer.example/.well-known/aauth-agent.json":
+                {"jwks_uri": "https://issuer.example/jwks.json"},
+            "https://issuer.example/jwks.json": {"keys": [issuer_jwk]},
+        }),
+    )
+    sig = await verifier.verify("POST", "https://api.example/v1/orders", headers)
+    assert sig is not None and sig.scheme == "aauth" and sig.sub == "agent-42"
+
+
 async def test_cache_is_per_instance() -> None:
     a, b = HttpsigVerifier(), HttpsigVerifier()
     a._cache_put("https://x.example/doc", {"keys": []}, ttl=60)