HTTP Message Signatures + tweaks - #22386
Closed
bagder wants to merge 9 commits into
Closed
Conversation
github-actions
Bot
added
cmdline tool
tests
libcurl API
CI
There was a problem hiding this comment.
Pull request overview
Adds experimental RFC 9421 HTTP Message Signatures (“httpsig”) support across libcurl and the curl CLI, including Ed25519 (backend-dependent) and HMAC-SHA256 signing, plus extensive new tests and documentation to validate behavior and usage.
Changes:
- Implement HTTP Message Signatures request signing in libcurl (
Curl_output_httpsig) and add an Ed25519 signing abstraction with OpenSSL/wolfSSL backends. - Add curl CLI flags (
--httpsig-*) with key-file loading, feature detection, and help/version reporting updates. - Add a new test block (5000–5021) covering basic signing, query/authority handling, header signing, skip-on-preexisting headers, and error cases; include test keys in the test suite.
Reviewed changes
Copilot reviewed 77 out of 77 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/libtest/Makefile.inc | Registers new libtests for httpsig coverage. |
| tests/libtest/lib5000.c | Adds a basic libcurl httpsig signing smoke test. |
| tests/libtest/lib5004.c | Adds an RFC test-vector libcurl httpsig signing test (created timestamp override). |
| tests/data/Makefile.am | Adds new httpsig testcases and distributes test key files. |
| tests/data/data-httpsig-ed25519.key | Adds Ed25519 test key material (hex) for the test suite. |
| tests/data/data-httpsig-hmac-sha256.key | Adds HMAC-SHA256 test key material (hex) for the test suite. |
| tests/data/test5000 | Adds CLI/libtest protocol verification for basic Ed25519 signing. |
| tests/data/test5001 | Adds CLI verification for signing with query present. |
| tests/data/test5002 | Adds CLI verification for HMAC-SHA256 signing. |
| tests/data/test5003 | Adds CLI verification for custom signed component sets. |
| tests/data/test5004 | Adds libtest-based verification for RFC 9421 Appendix B.2.6 vector. |
| tests/data/test5005 | Adds CLI verification for signing regular HTTP headers. |
| tests/data/test5006 | Adds CLI verification for component name case normalization. |
| tests/data/test5007 | Adds CLI verification for POST method signing. |
| tests/data/test5008 | Adds CLI error test for missing httpsig key. |
| tests/data/test5009 | Adds CLI error test for unsupported algorithm. |
| tests/data/test5010 | Adds CLI error test for non-existent key file. |
| tests/data/test5011 | Adds CLI test for query string special character handling. |
| tests/data/test5012 | Adds CLI test for default-port omission in @authority. |
| tests/data/test5013 | Adds CLI test for non-default port in @authority. |
| tests/data/test5014 | Adds CLI test for explicit @query when URL has no query. |
| tests/data/test5015 | Adds CLI test for HMAC-SHA256 POST signing. |
| tests/data/test5016 | Adds CLI test for HMAC-SHA256 with custom headers. |
| tests/data/test5017 | Adds CLI test ensuring preexisting Signature headers skip signing. |
| tests/data/test5018 | Adds CLI test for PUT upload signing. |
| tests/data/test5019 | Adds CLI error test for duplicate signed components. |
| tests/data/test5020 | Adds CLI error test rejecting legacy ‘@’-prefixed component syntax. |
| tests/data/test5021 | Adds CLI test for default algorithm behavior when omitted. |
| src/tool_listhelp.c | Documents new --httpsig-* CLI flags in curl --help. |
| src/tool_libinfo.h | Adds feature_httpsig runtime feature flag. |
| src/tool_libinfo.c | Detects HTTPSIG feature in libcurl feature list. |
| src/tool_getparam.h | Adds parameter IDs for new --httpsig-* options. |
| src/tool_getparam.c | Parses --httpsig-* options and wires them into config. |
| src/tool_cfgable.h | Adds OperationConfig storage for httpsig CLI options. |
| src/tool_cfgable.c | Frees new httpsig-related config fields. |
| src/curlinfo.c | Reports httpsig enable/disable status in curl -V “disabled” list. |
| src/config2setopts.c | Maps CLI httpsig options to libcurl setopts and loads key material from file. |
| projects/OS400/README.OS400 | Documents OS/400 CCSID handling for new httpsig string options. |
| projects/OS400/ccsidcurl.c | Adds CCSID conversions for new httpsig string options. |
| lib/version.c | Exposes HTTPSIG as a curl_version_info() feature string when enabled. |
| lib/urldata.h | Adds storage for httpsig strings and algorithm selection in UserDefined. |
| lib/setopt.c | Adds CURLOPT_HTTPSIG_* option handling and input validation. |
| lib/Makefile.inc | Adds new httpsig and Ed25519 implementation files to the build. |
| lib/http.c | Integrates HTTPSIG into HTTP auth selection/output path. |
| lib/http_httpsig.h | Declares Curl_output_httpsig() interface. |
| lib/http_httpsig.c | Implements RFC 9421 signature base construction, component parsing, and signing. |
| lib/easyoptions.c | Registers new easy options and updates the option-count self-check. |
| lib/curl_sha256.h | Ensures SHA256 APIs are available when httpsig is enabled. |
| lib/curl_setup.h | Disables httpsig automatically when HTTP is disabled. |
| lib/curl_hmac.h | Ensures HMAC APIs are available when httpsig is enabled. |
| lib/curl_ed25519.h | Adds Ed25519 signing abstraction for httpsig support. |
| lib/curl_ed25519.c | Implements Ed25519 signing via OpenSSL and wolfSSL, with fallback stubs. |
| lib/curl_config-cmake.h.in | Adds CMake config define for CURL_DISABLE_HTTPSIG. |
| include/curl/typecheck-gcc.h | Adds typecheck coverage for new string options. |
| include/curl/curl.h | Adds CURLAUTH_HTTPSIG, algorithm constants, and new CURLOPT_HTTPSIG_* options. |
| docs/options-in-versions | Documents new CLI options as added in 8.22.0. |
| docs/libcurl/symbols-in-versions | Documents new symbols/options as added in 8.22.0. |
| docs/libcurl/opts/Makefile.inc | Adds new option manpages to the build. |
| docs/libcurl/opts/CURLOPT_HTTPSIG_ALGORITHM.md | Documents libcurl API for selecting httpsig algorithm. |
| docs/libcurl/opts/CURLOPT_HTTPSIG_KEY.md | Documents libcurl API for providing the hex key material. |
| docs/libcurl/opts/CURLOPT_HTTPSIG_KEYID.md | Documents libcurl API for Signature-Input key identifier. |
| docs/libcurl/opts/CURLOPT_HTTPSIG_HEADERS.md | Documents libcurl API for selecting components/headers to sign. |
| docs/libcurl/opts/CURLOPT_HTTPAUTH.md | Documents CURLAUTH_HTTPSIG as a valid auth mode. |
| docs/libcurl/curl_version_info.md | Documents new HTTPSIG feature string in version info. |
| docs/libcurl/curl_easy_setopt.md | Lists new CURLOPT_HTTPSIG_* options. |
| docs/EXPERIMENTAL.md | Marks HTTPSIG as experimental and documents graduation requirements. |
| docs/CURL-DISABLE.md | Documents CURL_DISABLE_HTTPSIG. |
| docs/cmdline-opts/Makefile.inc | Adds new CLI option docs pages. |
| docs/cmdline-opts/httpsig-algo.md | Documents --httpsig-algo. |
| docs/cmdline-opts/httpsig-key.md | Documents --httpsig-key. |
| docs/cmdline-opts/httpsig-keyid.md | Documents --httpsig-keyid. |
| docs/cmdline-opts/httpsig-headers.md | Documents --httpsig-headers. |
| docs/cmdline-opts/.gitignore | Updates generated-doc ignore list. |
| configure.ac | Adds --enable-httpsig/--disable-httpsig and integrates feature reporting. |
| CMakeLists.txt | Adds CURL_DISABLE_HTTPSIG option and feature reporting integration. |
| .github/workflows/linux.yml | Enables httpsig in select CI configurations to exercise the feature. |
| .github/scripts/pyspelling.words | Adds new terms (httpsig/keyid/wolfCrypt) to spelling allowlist. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 77 out of 77 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
lib/http_httpsig.c:444
- The whitespace-skip loop after parsing components is missing braces, so the failf()/return always execute. This makes any request that sets CURLOPT_HTTPSIG_HEADERS fail with CURLE_BAD_FUNCTION_ARGUMENT ("too many signature components") even when the component count is within limits.
bagder
marked this pull request as ready for review
July 24, 2026 15:44
bagder
changed the title
oops Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
vszakats
added a commit
to curl/curl-for-win
that referenced
this pull request
Jul 29, 2026
vszakats
added a commit
that referenced
this pull request
Jul 30, 2026
Show a warning and force-disable HTTPSIG when the TLS backend is not OpenSSL or wolfSSL. Before this patch this resulted in a mismatched feature list in configure and `curl -V`. Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows compilers, clang-tidy, cmake. Follow-up to a557310 #22386 #21239 Cherry-picked from #22437 Closes #22439
vszakats
added a commit
that referenced
this pull request
Jul 30, 2026
Detected by torture tests: ``` test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)] 105 functions found, but only fail 25 (23.81%) ** MEMORY FAILURE Leak detected: memory still allocated: 99 bytes At 6000022c9408, there is 36 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:87 At 6000039c8e78, there is 31 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:87 At 6000037dd688, there is 16 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:62 At 6000037dd628, there is 16 bytes. allocated by /Users/runner/work/curl/curl/lib/slist.c:62 LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit 5004: torture FAILED: function number 10 in test. ``` Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331 Also: - enable HTTPSIG in torture tests. - NULL check all `curl_slist_append()` results. - apply a NULL check to sibling test 5000 also. Co-authored-by: Daniel Stenberg Follow-up to a557310 #22386 #21239 Closes #22437
vszakats
added a commit
that referenced
this pull request
Jul 30, 2026
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jul 31, 2026
vszakats
added a commit
that referenced
this pull request
Jul 31, 2026
vszakats
added a commit
that referenced
this pull request
Jul 31, 2026
vszakats
added a commit
that referenced
this pull request
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From #21239