Signature: Add option to use RFC-9421 signatures

[obenland]

Follow-up to #1849.

Proposed changes:

• Updated tests to expect deprecation warnings and use the new signature class.
• Added registration for the new RFC‑9421 signature option.
• Added a new settings field to toggle the modern signature format.
• Extended the interface to include RFC‑9421 signature and digest generation.
• Introduced RFC‑9421 compliant signing with updated signature base string.
• Updated draft signature implementation with its own digest generation.
• Refactored request signing to choose between the two signature methods.
• Reworked HTTP request creation to integrate the new signing approach.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Apply this PR to a site with followers.
• Publish a post or make a change to an actor.
• Make sure the Outbox item gets processed and sent successfully.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Optional support for RFC-9421 style signatures for outgoing activities, including retry with Draft-Cavage-style signature.

[obenland]

Does not do double-knocking yet Fixed!

[Copilot]

Pull Request Overview

This PR adds optional support for RFC‑9421 compliant signatures for outgoing ActivityPub requests and provides a fallback using the Draft‑Cavage signature method. Key changes include updating the test suite to use the new signature routines, adding a new admin setting for toggling signature format, and introducing updated implementations for the signature interfaces and classes.

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/includes/class-test-signature.php	Updated tests to expect deprecation warnings and use the new signature class
includes/wp-admin/class-settings.php	Added registration for the new RFC‑9421 signature option
includes/wp-admin/class-advanced-settings-fields.php	Added a new settings field to toggle the modern signature format
includes/signature/interface-signature-standard.php	Extended the interface to include RFC‑9421 signature and digest generation
includes/signature/class-http-message-signature.php	Introduced RFC‑9421 compliant signing with updated signature base string
includes/signature/class-draft-cavage-signature.php	Updated draft signature implementation with its own digest generation
includes/class-signature.php	Refactored request signing to choose between the two signature methods
includes/class-http.php	Reworked HTTP request creation to integrate the new signing approach

Comments suppressed due to low confidence (2)

includes/signature/class-http-message-signature.php:319

• Consider updating the docblock for get_signature_base_string to clarify how the $headers argument is merged with $params when $components is a list, ensuring the behavior aligns with the intended RFC‑9421 specifications.

	private function get_signature_base_string( $components, $params, $headers = array() ) {

includes/signature/class-draft-cavage-signature.php:129

• Verify that the digest format returned here (using 'sha256=' without surrounding colons) is the intended format for draft signatures and remains consistent with how the rest of the system expects the digest to be formatted.

		return 'sha256=' . \base64_encode( \hash( 'sha256', $body, true ) );

[pfefferle]

Nice!