[signatures] Include example of "@query-params" in list of covered components

[tyler-ham]

When composing a list of covered components in the @signature-params value, it wasn't clear to me if there should be multiple instances of "@query-params", one for each distinct name.

In Signature Parameters, 3., I see

Serialize the component identifiers of the covered components, including all parameters...

And in the HTTP Message Components section:

Component identifiers, including component identifiers with parameters, MUST NOT be repeated within a single list of covered components. Component identifiers with different parameter values MAY be repeated within a single list of covered components.

Both of these sound to me like "@query-params" should be repeated as shown below, once for each distinct name parameter. For example:

NOTE: '\' line wrapping per RFC 8792

("@path" "@authority" "@query-params";name="baz" \
  "@query-params";name="qux" "@query-params";name="param")\
  ;keyid="test-key-rsa-pss";alg="rsa-pss-sha512";\
  created=1618884475;expires=1618884775

Is this correct?

If so, would you be open to expanding at least one example to show that use of "@query-params" in a list of covered components?

[jricher]

Yes, there should be one instance of every @query-params used in the input list, with all of the parameters attached. Practically speaking, these are the same exact values as used in the generation of the signature base, on the left hand side of each line:

"@query-params";name="baz": batman
"@query-params";name="qux":
"@query-params";name="param": value

Would lead to a signature input of:

("@query-params";name="baz" "@query-params";name="qux" "@query-params";name="param")

Each one is considered its own separate component identifier. This pattern is true for all component identifiers.

We can add an example of an actual signature using this in the appendix section, and if you have suggestions on how we could make this more clear in the discussion on component identifiers or the signature params construct, we'd welcome suggestions on the text!

[tyler-ham]

Thank you! I am working on putting together some thoughts for the discussion on component identifiers.

Would you be open to a pull request adding this to an existing example, such as hmac-sha256? I'm happy to do some legwork if it is helpful, and I could make the corresponding change in http_sig_examples.py.