#459·xh

Stabilise HTTP message signatures support

Author: ducaaleCreated Apr 18, 2026Updated Jul 27, 2026

Now that cURL is adding support for HTTP Message Signatures, I think it is safe to stabilise the implementation we have.

  • Wait until httpsig-rs can use stable version of rsa crate. See https://github.com/RustCrypto/RSA/issues/647
  • Include http-message-signatures feature in default.
  • Similar to cURL, --unstable-m-sig-key should only accept path to a file
  • Rename the following options:
    • --unstable-m-sig-id -> --httpsig-keyid
    • --unstable-m-sig-key -> --httpsig-key
    • --unstable-m-sig-alg -> --httpsig-algorithm
    • --unstable-m-sig-comp -> --httpsig-components