Stabilise HTTP message signatures support
Author: ducaaleCreated Apr 18, 2026Updated Jul 27, 2026
Now that cURL is adding support for HTTP Message Signatures, I think it is safe to stabilise the implementation we have.
- Wait until
httpsig-rscan use stable version of rsa crate. See https://github.com/RustCrypto/RSA/issues/647 - Include
http-message-signaturesfeature indefault. - Similar to cURL,
--unstable-m-sig-keyshould only accept path to a file - Rename the following options:
--unstable-m-sig-id->--httpsig-keyid--unstable-m-sig-key->--httpsig-key--unstable-m-sig-alg->--httpsig-algorithm--unstable-m-sig-comp->--httpsig-components
Source: ducaale/xh