feat(network): add transparent request signing (bot-auth)#1062
Merged
Conversation
Implement Ed25519 request signing per RFC 9421 / web-bot-auth profile, matching the toolkit library contract section 9 and fetchkit's reference implementation. - Feature-gated behind `bot-auth` cargo feature (implies `http_client`) - BotAuthConfig: from_seed, from_base64_seed, agent_fqdn, validity_secs - Transparent: all outbound HTTP requests signed automatically - Non-blocking: signing failures never prevent requests - derive_bot_auth_public_key() for consumer key directory serving - JWK Thumbprint (RFC 7638) as key identity - 10 unit tests covering signing, verification, key derivation Closes #1032
Add safe-to-deploy exemptions for 17 transitive dependencies introduced by ed25519-dalek (curve25519-dalek, fiat-crypto, etc.).
Reorder exemptions to match cargo-vet's expected alphabetical sort.
- 017-request-signing: add table showing all HTTP paths are signed (request_with_headers, request_with_timeouts, custom HttpHandler, redirects) - 005-builtins: add http builtin docs, note bot-auth coverage for all network builtins - 006-threat-model: add TM-NET-021 for bot identity spoofing mitigation - network/mod.rs: mention request signing in security model docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bot-authcargo feature (implieshttp_client) — zero crypto deps when disabledSignature,Signature-Input, and optionalSignature-Agentheaders automaticallyBotAuthConfigshape, signing format, header names)derive_bot_auth_public_key()for consumer key directory servingTest plan
bot_auth.rscovering seed construction, base64 decoding, signing, Ed25519 verification, JWK thumbprint, validity window, public key derivationcargo fmt --checkpassescargo clippy --all-targets --features bot-auth -p bashkit -- -D warningspasses (zero warnings)cargo test --features bot-auth -p bashkit— 2042+ tests pass, 0 failureshttp_clientonly, andbot-authCloses #1032