Signatures: Add basic support for RFC-9421

[obenland]

Fixes #1808.

Proposed changes:

• Refactored the signature verification logic in Signature::verify_http_signature to delegate to new standard-specific classes.
• Added Draft_Cavage_Signature and Http_Message_Signature classes implementing a new Signature_Standard interface, supporting both the legacy draft-cavage and new HTTP Message Signature (RFC 9421) standards.
• Deprecated and stubbed out legacy parsing and verification helpers in class-signature.php.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• No one is using the new standard yet, so unit tests probably suffice.
• Apply the PR to a test site that's accessible from the internet.
• Make sure receiving activities still works as expected.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Added basic support for RFC-9421 style signatures for incoming activities.

[obenland]

Done:

• Parsing and verifying Signature-Input and Signature headers.
• Dynamic label support (e.g., @method, @target-uri, etc.).
• Parameter support (alg=, created=, expires=, nonce=, keyid=).
• Canonicalization of headers (whitespace folding and trimming).
• Digest validation.
• Multiple signature label support (e.g., sig1=, sig2=).
• Signature string composition separated out.
• Algorithm resolution based on alg and key details (with PHP version check).

Skipped for now:

• Structured field parsing
• Nonce uniqueness tracking

What do you think @mediaformat?

[Copilot]

Pull Request Overview

Adds modular support for both the legacy Draft Cavage and new RFC-9421 HTTP Message Signature standards by refactoring the centralized verification logic into standard‐specific classes.

• Delegates signature verification in Signature::verify_http_signature to Draft_Cavage_Signature and Http_Message_Signature via a new Signature_Standard interface.
• Implements Http_Message_Signature (RFC-9421) and Draft_Cavage_Signature classes, each handling parsing, validation, and verification for their respective standards.
• Deprecates and stubs out the legacy parsing and verification helpers in class-signature.php.

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/includes/rest/class-test-signature-verification.php	Removed legacy HTTP signature tests; needs replacement for new classes
tests/fixtures/http-signature-keys.json	Added key fixtures for EC and RSA variants used by new signature tests
includes/signature/interface-signature-standard.php	Introduced Signature_Standard interface for pluggable verification
includes/signature/class-http-message-signature.php	Added RFC-9421 HTTP Message Signature implementation
includes/signature/class-draft-cavage-signature.php	Added Draft Cavage HTTP Signature implementation
includes/class-signature.php	Updated verify_http_signature to dispatch to new standards; stubbed legacy methods

Comments suppressed due to low confidence (2)

includes/class-signature.php:251

• [nitpick] The variable name $signature shadows the concept of the header and may be confusing; consider renaming it to $verifier or $signature_standard for clarity.

		$signature = isset( $headers['signature_input'] ) ? new Http_Message_Signature() : new Draft_Cavage_Signature();

[pfefferle]

Suggested change

	{"path": "includes/signature", "label": "[Feature] Signature"},
	{"path": "includes/signature", "label": "[Feature] Signature"},
	{"path": "includes/class-signature.php", "label": "[Feature] Signature"},

[obenland]

I was planning on moving class-signature.php into /includes/signature in a follow-up PR, would that work for you?

[pfefferle]

I think best practice is to have the main class (or factory or however you want to call it) in the root and only the special cases in the subfolder, so I quite like the structure as is. that said, we havent't done that with transformers, so it would be at least consistent to move it 🫣

[mediaformat]

• Parsing and verifying Signature-Input and Signature headers.
• Dynamic label support (e.g., @method, @target-uri, etc.).
• Parameter support (alg=, created=, expires=, nonce=, keyid=).
• Canonicalization of headers (whitespace folding and trimming).
• Digest validation.
• Multiple signature label support (e.g., sig1=, sig2=).
• Signature string composition separated out
• Algorithm resolution based on alg and key details (with PHP version check).

Only looked at the code so far, but looks great!

[obenland]

@pfefferle I think this is ready for another look. Unit tests look firm now and #1858 helped polish out some remaining bugs. As long as legacy signatures still work this should be safe to merge.