Crate asimov_http 

Shared HTTP integrity and client proxy configuration.

SHA-256 is the sole digest algorithm (RFC 9530). With integrity, this crate implements RFC 9421 Ed25519 signatures using Iroh’s base key types, HTTP message-component canonicalization, and frame-preserving body adapters. SHA-256 hashing and digest-field encoding are also available without std.

Features

• integrity (default): signatures, message contexts, and body adapters; implies std. Callers previously using only std must enable integrity to retain these APIs.
• proxy: proxy options, URL validation, and proxy errors with no_std and alloc support.
• system-proxy: origin-scoped environment/native discovery; implies std and proxy.
• reqwest: the origin-scoped reqwest proxy adapter; implies system-proxy.
• hyper: effective proxy endpoint selection for Hyper connectors, including shared bypass handling; implies system-proxy.

Proxy features do not enable integrity or its key dependencies. Use default-features = false to select them independently. Native proxy readers and client adapters are absent from integrity-only builds.

Signature processing operates on an explicit message context, independently of HTTP versions and body types. Servers supply the externally visible target URI, including trusted proxy routing context, rather than guessing a scheme from an incoming origin-form URI. See Message and SignatureInput.

Streaming bodies deliver provisional data and verify at EOF. Callers must consume the entire stream and observe its terminal result before treating the message as authenticated. Dropping a body early never verifies it. Application authorization and atomic nonce-replay rejection follow successful signature AND body verification; freshness checks alone do not prevent replay.

Buffered requests

use asimov_http::{
    SecretKey, SignatureInput, SignatureParams, Signer, VerificationPolicy,
    REQUEST_SIGNATURE_TAG, body::sign_request, http::Request,
};

let key = SecretKey::generate(); // Or load the protocol identity from keyring.
let input = SignatureInput::new(
    VerificationPolicy::request().required_components,
    SignatureParams::fresh(&key.public(), REQUEST_SIGNATURE_TAG)?,
)?;
let signer = Signer::new(key, "asimov", input)?;
let target = "https://example.com/fetch";
let mut request = Request::post(target)
    .header("authorization", "Bearer token")
    .header("accept", "application/jsonl")
    .header("content-type", "application/json")
    .body(br#"{"urls":["example:"]}"#.as_slice())?;
sign_request(&mut request, target, &signer)?;

Streaming responses

use asimov_http::{
    Component, FieldSection, SecretKey, SignatureInput, SignatureParams,
    Signer, body::SigningBody, http::Response,
};
use bytes::Bytes;
use http_body_util::Full;

let key = SecretKey::generate();
let input = SignatureInput::new(vec![
    Component::new("@status")?,
    Component::new("content-type")?,
    Component::trailer("content-digest")?,
], SignatureParams::fresh(&key.public(), "example-response")?)?;
let signer = Signer::new(key, "asimov", input)?;
// Any http_body::Body<Data = Bytes> works, including an unbounded stream.
let response = Response::builder()
    .header("content-type", "application/jsonl")
    .body(Full::new(Bytes::from_static(b"{}\n")))?;
let response = SigningBody::response(
    response, None, Some(signer), FieldSection::Headers,
)?;
// Send with Hyper. Content-Digest and Signature are produced at EOF.

Re-exports

pub use http;integrity

Modules

bodyintegrity

Frame-preserving HTTP/1.1 and HTTP/2 body adapters.

proxyproxy

Shared HTTP proxy options and endpoint validation (proxy feature).

Structs

Componentintegrity

An RFC 9421 component identifier with ordered parameters.

ContentDigest

A SHA-256 digest of content bytes, after content coding and before framing.

DigestOptions

RFC 9530 output fields for a complete, buffered representation.

DigestPreference

A SHA-256 preference weight for Want-Content-Digest or Want-Repr-Digest. Zero means unacceptable, one least preferred, and ten most preferred.

Messageintegrity

Owned signature context, independent of HTTP versions and body types.

SecretKeyintegrity

A secret key.

SignatureFieldsintegrity

The two RFC 9421 fields for a single signature label.

SignatureInputintegrity

An ordered, validated RFC 9421 inner list and its signature parameters.

SignatureParamsintegrity

Parameters for newly generated Ed25519 signatures.

Signerintegrity

An Ed25519 signer for one signature input and label.

VerificationPolicyintegrity

Required coverage and freshness for an application of RFC 9421.

VerifiedSignatureintegrity

A signature successfully checked against an explicit key and policy. This alone does not attest body integrity or application authorization.

Verifierintegrity

Verification against one application-resolved key, label, and policy.

Enums

Errorintegrity

HTTP integrity construction, parsing, or verification failure.

FieldSectionintegrity

The field section containing a digest, signature, or covered HTTP field.

StructuredFieldTypeintegrity

The known type of a Structured Field covered using ;sf.

Constants

REQUEST_SIGNATURE_TAGintegrity

Application tag for ASIMOV remote execution requests.

Functions

key_idintegrity

ASCII key identifier used by ASIMOV’s HTTP signature profiles.

Type Aliases

VerifyingKeyintegrity

The identifier for an endpoint in the (iroh) network.