mirror of
https://github.com/fleetdm/fleet
synced 2026-05-06 06:48:54 +00:00
c25fed2492
For #30473 This change adds a vendored `httpsig-go` library to our repo. We cannot use the upstream library because it has not merged the change we need: https://github.com/remitly-oss/httpsig-go/pull/25 Thus, we need our own copy at this point. The instructions for keeping this library up to date (if needed) are in `UPDATE_INSTRUCTIONS`. None of the coderabbitai review comments are relevant to the code/features we are going to use for HTTP message signatures. We will use this library in subsequent PRs for the TPM-backed HTTP message signature feature. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a Go library for HTTP message signing and verification, supporting multiple cryptographic algorithms (RSA, ECDSA, Ed25519, HMAC). * Added utilities for key management, including JWK and PEM key handling. * Provided HTTP client and server helpers for automatic request signing and signature verification. * Implemented structured error handling and metadata extraction for signatures. * **Documentation** * Added comprehensive README, usage examples, and update instructions. * Included license and configuration files for third-party and testing tools. * **Tests** * Added extensive unit, integration, and fuzz tests covering signing, verification, and key handling. * Included official RFC test vectors and various test data files for robust validation. * **Chores** * Integrated continuous integration workflows and ignore files for code quality and security analysis. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|---|---|---|
| .. | ||
| fuzz | ||
| b21_request_sigbase.txt | ||
| b21_request_signed.txt | ||
| b22_request_sigbase.txt | ||
| b22_request_signed.txt | ||
| b23_request_sigbase.txt | ||
| b23_request_signed.txt | ||
| b24_response_sigbase.txt | ||
| b24_response_signed.txt | ||
| b25_request_sigbase.txt | ||
| b25_request_signed.txt | ||
| b26_request_sigbase.txt | ||
| b26_request_signed.txt | ||
| key-rsa-v15.key | ||
| key-rsa-v15.pub | ||
| request1.txt | ||
| request_bad_digest.txt | ||
| request_multivalue.txt | ||
| request_no_digest.txt | ||
| request_repeated_components.txt | ||
| rfc-test-request.txt | ||
| rfc-test-response.txt | ||
| test-key-ecc-p256.key | ||
| test-key-ecc-p256.pub | ||
| test-key-ecc-p384.key | ||
| test-key-ecc-p384.pub | ||
| test-key-ed25519.key | ||
| test-key-ed25519.pub | ||
| test-key-rsa-pss.key | ||
| test-key-rsa-pss.pub | ||
| test-key-rsa.key | ||
| test-key-rsa.pub | ||
| test-shared-secret | ||
| verify_request1.txt | ||
| verify_request2.txt | ||