Repository navigation
v2: implement draft-hardt-httpbis-signature-key-08 #2
Description
The signature-key draft has moved to -08, which is not backward compatible with the -05 wire format this library (1.1.0) implements. @hellocoop/httpsig 2.0.0-alpha.2 already implements -08 and is the reference to match.
Needed for the Hellō Wallet mobile work (Wallet MULTI_SESSION_MOBILE_PLAN.md, cross-cutting Signature-Key -08 item):
- Implement the -08 wire format as a v2 release (breaking; both
hwkandjkt-jwtschemes) - Cross-verify against
@hellocoop/httpsig2.0.0-alpha.x (sign here, verify there, and vice versa) - The iOS app then bumps its SPM pin; the Wallet server runs a dual-accept window (-08 first, -05 fallback) until heartbeat telemetry shows no -05 signers remain — fielded app builds sign -05 and cannot be flag-dayed
🤖 Generated with Claude Code
Activity
dickhardt commentedon Aug 6, 2026
Concrete -05 → -08 wire deltas, observed while building the Android (kotlin-httpsig) implementation and contract-testing it against @hellocoop/httpsig 2.0.0-alpha.2 and 1.x:
alg(RFC 9864) —"Ed25519", not"EdDSA". v2 rejects delegation JWTs whoseheader.jwkorcnf.jwklack it. For this library that meansKeyDelegation.swiftaddsalgto both JWKs.hwkmust NOT carrykid(rejected by v2).signature-keycoverage is unconditionally enforced (v1'sstrictAAuthoption removed).sigkeyparam →Accept-Signature-Scheme/Accept-Signature-Algheaders;supported_algorithmsremoved fromSignature-Error; new error codesunsupported_scheme,issuer_missing/issuer_mismatch.Signature-Inputmust never emit analgparameter (now normative).created, jkt-jwt serialization, and RFC 7638 thumbprints are unchanged — device identity is draft-stable.Useful property confirmed by the cross-tests: the -08 shape verifies under v1 too (v1 ignores the
algmembers; only very old Node WebCrypto chokes onalg:"Ed25519"at OKP import — Node 22 accepts it). So clients can move to -08 ahead of servers adopting 2.x verification.Reference harness:
android/httpsig/cross-test/verify.mjsin the mobile repo's worktree-android branch — sign in Kotlin, verify with both JS library versions; the same sign-here-verify-there pattern is recommended for the Swift v2 work.🤖 Generated with Claude Code
https://claude.ai/code/session_01HwkJrWKDtRp8KrQXL9rfTz