Versions in this module Expand all Collapse all v1 v1.0.0 Aug 25, 2026 Changes in this version + const DefaultMaxSignatureBaseBytes + var ErrAmbiguousProtectedField = errors.New("http signature: ambiguous protected HTTP field") + var ErrBodyRead = errors.New("http signature: body unavailable for digest") + var ErrBodyTooLarge = errors.New("http signature: body exceeds digest buffer") + var ErrDigestMismatch = errors.New("http signature: digest mismatch") + var ErrExistingDigest = errors.New("http signature: existing Content-Digest rejected") + var ErrExistingSignatures = errors.New("http signature: existing signature fields rejected") + var ErrHTTPIntegrationSigning = errors.New("http signature: HTTP request signing failed") + var ErrHTTPIntegrationVerification = errors.New("http signature: HTTP response verification failed") + var ErrIncompatibleKey = errors.New("http signature: incompatible key") + var ErrInvalidAcceptSignature = errors.New("http signature: invalid Accept-Signature field") + var ErrInvalidBodyIntegration = errors.New("http signature: invalid body digest integration") + var ErrInvalidDigestField = errors.New("http signature: invalid digest field") + var ErrInvalidDigestPreferences = errors.New("http signature: invalid digest preferences") + var ErrInvalidHTTPIntegration = errors.New("http signature: invalid HTTP integration") + var ErrInvalidReplayConfig = errors.New("http signature: invalid replay store configuration") + var ErrInvalidReplayRecord = errors.New("http signature: invalid replay record") + var ErrInvalidSignature = errors.New("http signature: invalid Signature field") + var ErrInvalidSignatureInput = errors.New("http signature: invalid Signature-Input field") + var ErrInvalidSignatureValue = errors.New("http signature: invalid signature value") + var ErrInvalidSignedFields = errors.New("http signature: invalid signed fields") + var ErrInvalidSigningProfile = errors.New("http signature: invalid signing profile") + var ErrInvalidSyntaxLimits = errors.New("http signature: invalid syntax limits") + var ErrInvalidVerificationProfile = errors.New("http signature: invalid verification profile") + var ErrKeyNotFound = errors.New("http signature: verification key not found") + var ErrKeyResolutionFailure = errors.New("http signature: verification key resolution failed") + var ErrMissingDigest = errors.New("http signature: required digest is missing") + var ErrReplayBackendFailure = errors.New("http signature: replay backend failed") + var ErrReplayCapacity = errors.New("http signature: replay store capacity exceeded") + var ErrReplayDetected = errors.New("http signature: replay detected") + var ErrResponseBodyTooLarge = errors.New("http signature: response body exceeds signing buffer") + var ErrSignatureBase = errors.New("http signature: cannot create signature base") + var ErrSignatureBaseLimit = fmt.Errorf("%w: resource limit exceeded", ErrSignatureBase) + var ErrSignatureRandomness = errors.New("http signature: signing randomness unavailable") + var ErrSigningBase = errors.New("http signature: signing base unavailable") + var ErrSigningCryptographic = errors.New("http signature: cryptographic signing failed") + var ErrSigningKey = errors.New("http signature: signing key unavailable") + var ErrSigningPolicy = errors.New("http signature: signing policy rejected request") + var ErrSigningProvider = errors.New("http signature: signing key provider failed") + var ErrSyntaxLimit = errors.New("http signature: syntax resource limit exceeded") + var ErrUnsupportedDigestAlgorithm = errors.New("http signature: unsupported digest algorithm") + var ErrUnsupportedSignatureAlgorithm = errors.New("http signature: unsupported signature algorithm") + func CombineSignedFields(fields ...SignedFields) (SignatureInputs, Signatures, error) + func CreateSignatureBase(context MessageContext, input SignatureInput) (string, error) + func Sign(ctx context.Context, algorithm Algorithm, key any, signatureBase []byte, ...) ([]byte, error) + func Verify(ctx context.Context, algorithm Algorithm, key any, ...) error + type AcceptSignatures struct + func ParseAcceptSignatures(values []string) (AcceptSignatures, error) + func ParseAcceptSignaturesWithLimits(values []string, limits SyntaxLimits) (AcceptSignatures, error) + func (requests AcceptSignatures) Entries() []SignatureRequest + func (requests AcceptSignatures) String() string + type Algorithm string + const ECDSAP256SHA256 + const ECDSAP384SHA384 + const Ed25519 + const HMACSHA256 + const RSAPSSSHA512 + const RSAV15SHA256 + type BufferedContentDigestRoundTripper struct + func NewBufferedContentDigestRoundTripper(config BufferedContentDigestRoundTripperConfig) (*BufferedContentDigestRoundTripper, error) + func (transport *BufferedContentDigestRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) + type BufferedContentDigestRoundTripperConfig struct + Algorithms []DigestAlgorithm + MaxBytes int64 + Transport http.RoundTripper + type BufferedContentDigestVerificationMiddleware func(http.Handler) http.Handler + func NewBufferedContentDigestVerificationMiddleware(config BufferedContentDigestVerificationMiddlewareConfig) (BufferedContentDigestVerificationMiddleware, error) + type BufferedContentDigestVerificationMiddlewareConfig struct + MapError func(http.ResponseWriter, *http.Request, error) + MaxBytes int64 + RequiredAlgorithms []DigestAlgorithm + type BufferedTrailerVerificationMiddleware func(http.Handler) http.Handler + func NewBufferedTrailerVerificationMiddleware(config BufferedTrailerVerificationMiddlewareConfig) (BufferedTrailerVerificationMiddleware, error) + type BufferedTrailerVerificationMiddlewareConfig struct + ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error) + MapError func(http.ResponseWriter, *http.Request, error) + MaxBytes int64 + RequiredAlgorithms []DigestAlgorithm + SelectLabel func(*http.Request, SignatureInputs, Signatures) (string, error) + Verifier *Verifier + type BufferedTrailerVerifyingRoundTripper struct + func NewBufferedTrailerVerifyingRoundTripper(config BufferedTrailerVerifyingRoundTripperConfig) (*BufferedTrailerVerifyingRoundTripper, error) + func (transport *BufferedTrailerVerifyingRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) + type BufferedTrailerVerifyingRoundTripperConfig struct + ExternalContext func(context.Context, *http.Request, *http.Response) (*ExternalRequestContext, error) + MaxBytes int64 + RequiredAlgorithms []DigestAlgorithm + SelectLabel func(*http.Request, *http.Response, SignatureInputs, Signatures) (string, error) + Transport http.RoundTripper + Verifier *Verifier + type ComponentIdentifier struct + Name string + Parameters []Parameter + func (component ComponentIdentifier) Parameter(name string) (any, bool) + type Digest struct + Algorithm DigestAlgorithm + Parameters []Parameter + Value []byte + type DigestAlgorithm string + const SHA256 + const SHA512 + type DigestField struct + func ComputeDigests(algorithms []DigestAlgorithm, content []byte) (DigestField, error) + func ParseDigestField(value string) (DigestField, error) + func ParseDigestFields(values []string) (DigestField, error) + func ParseDigestFieldsWithLimits(values []string, limits SyntaxLimits) (DigestField, error) + func (field DigestField) Entries() []Digest + func (field DigestField) String() string + func (field DigestField) Verify(content []byte, required []DigestAlgorithm) error + type DigestPreference struct + Algorithm DigestAlgorithm + Weight int64 + type DigestPreferences struct + func NewDigestPreferences(entries []DigestPreference) (DigestPreferences, error) + func ParseDigestPreferences(values []string) (DigestPreferences, error) + func ParseDigestPreferencesWithLimits(values []string, limits SyntaxLimits) (DigestPreferences, error) + func (preferences DigestPreferences) Entries() []DigestPreference + func (preferences DigestPreferences) String() string + type ExistingSignaturesPolicy uint8 + const ExistingSignaturesAppend + const ExistingSignaturesReject + type ExternalRequestContext struct + Authority string + RequestTarget string + Scheme string + type HMACKey struct + func NewHMACKey(material []byte) (HMACKey, error) + type KeyResolver interface + Resolve func(context.Context, string) (ResolvedKey, error) + type MemoryReplayConfig struct + Capacity int + MaxKeyIDBytes int + MaxNonceBytes int + MaxTTL time.Duration + Now func() time.Time + type MemoryReplayStore struct + func NewMemoryReplayStore(config MemoryReplayConfig) (*MemoryReplayStore, error) + func (store *MemoryReplayStore) Consume(ctx context.Context, record ReplayRecord) error + type MessageContext struct + ExternalRequest *ExternalRequestContext + MaxSignatureBaseBytes int + RelatedRequest *http.Request + Request *http.Request + Response *http.Response + ResponseTransport ResponseTransportMode + StructuredFields map[string]StructuredFieldType + type Parameter struct + Name string + Value any + type ParameterPolicy uint8 + const ParameterForbidden + const ParameterOptional + const ParameterRequired + type ReplayRecord struct + ExpiresAt time.Time + KeyID string + Nonce string + type ReplayStore interface + Consume func(context.Context, ReplayRecord) error + type RequestVerificationMiddleware func(http.Handler) http.Handler + func NewRequestVerificationMiddleware(config RequestVerificationMiddlewareConfig) (RequestVerificationMiddleware, error) + type RequestVerificationMiddlewareConfig struct + ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error) + MapError func(http.ResponseWriter, *http.Request, error) + SelectLabel func(*http.Request, SignatureInputs, Signatures) (string, error) + Verifier *Verifier + type ResolvedKey struct + Algorithm Algorithm + FreshUntil time.Time + Key any + NotAfter time.Time + NotBefore time.Time + Revoked bool + type ResponseSigningMiddleware func(http.Handler) http.Handler + func NewResponseSigningMiddleware(config ResponseSigningMiddlewareConfig) (ResponseSigningMiddleware, error) + type ResponseSigningMiddlewareConfig struct + ContentDigestAlgorithms []DigestAlgorithm + Existing ExistingSignaturesPolicy + ExternalContext func(context.Context, *http.Request, *http.Response) (*ExternalRequestContext, error) + Label string + MapError func(http.ResponseWriter, *http.Request, error) + MaxBufferedBytes int64 + Options func(context.Context, *http.Request, *http.Response) (SigningOptions, error) + ReportError func(*http.Request, error) + Signer *Signer + type ResponseTransportMode uint8 + const ResponseTransportReceived + const ResponseTransportUnspecified + const ResponseTransportWrite + type SFToken string + type SignatureInput struct + Components []ComponentIdentifier + Label string + Parameters []Parameter + func (input SignatureInput) Parameter(name string) (any, bool) + type SignatureInputs struct + func ParseSignatureInputs(values []string) (SignatureInputs, error) + func ParseSignatureInputsWithLimits(values []string, limits SyntaxLimits) (SignatureInputs, error) + func (inputs SignatureInputs) Entries() []SignatureInput + func (inputs SignatureInputs) String() string + type SignatureRequest = SignatureInput + type SignatureValue struct + Label string + Parameters []Parameter + Value []byte + type Signatures struct + func ParseSignatures(values []string) (Signatures, error) + func ParseSignaturesWithLimits(values []string, limits SyntaxLimits) (Signatures, error) + func (signatures Signatures) Entries() []SignatureValue + func (signatures Signatures) String() string + type SignedFields struct + func (signed SignedFields) SignatureField() string + func (signed SignedFields) SignatureInputField() string + type Signer struct + func NewSigner(profile *SigningProfile) *Signer + func (signer *Signer) Sign(ctx context.Context, message MessageContext, label string, ...) (SignedFields, error) + type SigningKey struct + Algorithm Algorithm + Key any + KeyID string + NotAfter time.Time + NotBefore time.Time + Revoked bool + type SigningKeyProvider interface + SigningKey func(context.Context) (SigningKey, error) + type SigningOptions struct + Nonce string + type SigningProfile struct + func NewSigningProfile(config SigningProfileConfig) (*SigningProfile, error) + type SigningProfileConfig struct + AlgorithmParameter ParameterPolicy + AllowEmptyCoverage bool + AllowedAlgorithms []Algorithm + CoveredComponents []ComponentIdentifier + Expires ParameterPolicy + Lifetime time.Duration + Nonce ParameterPolicy + Now func() time.Time + Provider SigningKeyProvider + Random io.Reader + RequireExternalRequestContext bool + ResolveTimeout time.Duration + Tag ParameterPolicy + TagValue string + type SigningRoundTripper struct + func NewSigningRoundTripper(config SigningRoundTripperConfig) (*SigningRoundTripper, error) + func (transport *SigningRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) + type SigningRoundTripperConfig struct + Existing ExistingSignaturesPolicy + ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error) + Label string + Options func(context.Context, *http.Request) (SigningOptions, error) + Signer *Signer + Transport http.RoundTripper + type StructuredFieldType uint8 + const StructuredFieldDictionary + const StructuredFieldItem + const StructuredFieldList + type SyntaxLimits struct + MaxBinaryBytes int + MaxComponentsPerSignature int + MaxDictionaryMembers int + MaxFieldBytes int + MaxFieldLines int + MaxParametersPerItem int + func DefaultSyntaxLimits() SyntaxLimits + func (limits SyntaxLimits) Validate() error + type TrailerResponseSigningMiddleware func(http.Handler) http.Handler + func NewTrailerResponseSigningMiddleware(config TrailerResponseSigningMiddlewareConfig) (TrailerResponseSigningMiddleware, error) + type TrailerResponseSigningMiddlewareConfig struct + Algorithms []DigestAlgorithm + ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error) + Label string + MaxBytes int64 + Options func(context.Context, *http.Request) (SigningOptions, error) + ReportError func(*http.Request, error) + Signer *Signer + type TrailerSigningRoundTripper struct + func NewTrailerSigningRoundTripper(config TrailerSigningRoundTripperConfig) (*TrailerSigningRoundTripper, error) + func (transport *TrailerSigningRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) + type TrailerSigningRoundTripperConfig struct + Algorithms []DigestAlgorithm + ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error) + Label string + MaxBytes int64 + Options func(context.Context, *http.Request) (SigningOptions, error) + Signer *Signer + Transport http.RoundTripper + type VerificationError struct + Failure VerificationFailure + func (err *VerificationError) Error() string + func (err *VerificationError) Unwrap() error + type VerificationFailure string + const VerificationAlgorithm + const VerificationBase + const VerificationCryptographic + const VerificationKey + const VerificationKeyResolution + const VerificationPolicy + const VerificationReplay + const VerificationSelection + const VerificationTime + type VerificationProfile struct + func NewVerificationProfile(config VerificationProfileConfig) (*VerificationProfile, error) + type VerificationProfileConfig struct + AlgorithmParameter ParameterPolicy + AllowEmptyCoverage bool + AllowedAlgorithms []Algorithm + AllowedTags []string + ClockSkew time.Duration + Created ParameterPolicy + Expires ParameterPolicy + MaxAge time.Duration + Nonce ParameterPolicy + Now func() time.Time + Replay ReplayStore + ReplayTimeout time.Duration + RequireExternalRequestContext bool + RequiredComponents []ComponentIdentifier + ResolveTimeout time.Duration + Resolver KeyResolver + Tag ParameterPolicy + type VerifiedSignature struct + Algorithm Algorithm + Created time.Time + Expires time.Time + KeyID string + Label string + func VerifiedSignatureFromContext(ctx context.Context) (VerifiedSignature, bool) + func VerifiedSignatureFromResponse(response *http.Response) (VerifiedSignature, bool) + type Verifier struct + func NewVerifier(profile *VerificationProfile) *Verifier + func (verifier *Verifier) Verify(ctx context.Context, message MessageContext, label string, ...) (VerifiedSignature, error) + type VerifyingRoundTripper struct + func NewVerifyingRoundTripper(config VerifyingRoundTripperConfig) (*VerifyingRoundTripper, error) + func (transport *VerifyingRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) + type VerifyingRoundTripperConfig struct + ContentDigestAlgorithms []DigestAlgorithm + ExternalContext func(context.Context, *http.Request, *http.Response) (*ExternalRequestContext, error) + MaxBufferedBytes int64 + SelectLabel func(*http.Request, *http.Response, SignatureInputs, Signatures) (string, error) + Transport http.RoundTripper + Verifier *Verifier
Go to main page