Skip to content

[Go] Support HTTP signature #4959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 78 commits into from
Feb 1, 2020

Conversation

sebastien-rosset
Copy link
Contributor

@sebastien-rosset sebastien-rosset commented Jan 10, 2020

This is adding a new "HTTP signature" security schemes (https://datatracker.ietf.org/doc/draft-cavage-http-signatures/). HTTP signatures is still a IETF draft, and hopefully it will become an official RFC this year. On one hand one may argue it shouldn’t be added because it’s still a draft, but on the other hand it is already being used by multiple products, so there may be benefits to support it. It is possible multiple organizations are independently adding the same security scheme.

Ideally one way to address the problem would be to make it possible to add new security schemes (such as HTTP signature) without being required to fork the OpenAPITools repo. But given the current code structure, it’s not clear to me how this could be achieved. Adding new security schemes involves surgery in multiple locations (Java codegen, templates, mustache tags).

I raised this point in Slack before opening the PR.

This PR depends on #4993 and #4934

PR checklist

  • Read the contribution guidelines.
  • If contributing template-only or documentation-only changes which will change sample output, build the project before.
  • Run the shell script(s) under ./bin/ (or Windows batch scripts under.\bin\windows) to update Petstore samples related to your fix. This is important, as CI jobs will verify all generator outputs of your HEAD commit, and these must match the expectations made by your contribution. You only need to run ./bin/{LANG}-petstore.sh, ./bin/openapi3/{LANG}-petstore.sh if updating the code or mustache templates for a language ({LANG}) (e.g. php, ruby, python, etc).
  • File the PR against the correct branch: master, 4.3.x, 5.0.x. Default: master.
  • Copy the technical committee to review the pull request if your PR is targeting a particular programming language.

@sebastien-rosset
Copy link
Contributor Author

sebastien-rosset commented Jan 14, 2020

There is a dependency on golang 1.10.
What is the version of golang being used to build the "go" and "go-experimental" artifacts? It looks like it is a version < 1.10. Where is this specified? What is the rule for upgrading the go version? For example, how do you decide whether it's ok to upgrade to 1.13.6? This PR uses strings.Builder, but that is defined in 1.10 and above. Should I write code to do the equivalent of strings.Builder? Or submit another PR to upgrade the version of golang?

Update: golang 1.10 dependency is no longer needed. I am using bytes.Buffer. The circleCI build environment should be improved to give better control over the version of golang, but that should be done in a separate PR.

@jimschubert
Copy link
Member

I kicked off CircleCI again, since it failed but at quick glance it seemed unrelated to work in this PR.

@sebastien-rosset
Copy link
Contributor Author

I just learned some people save their private key with file extensions other than ".pem", so I am going to relax the validation of the private key suffix.

@sebastien-rosset
Copy link
Contributor Author

@antihax @bvwells @grokify @kemokemo @bkabrda

A similar implementation has been done for Python and was merged to master.

Copy link
Member

@jimschubert jimschubert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jimschubert jimschubert added Client: Go Enhancement: Feature Bleeding Edge Experimental features (e.g. non-standard spec, "futures", or IETF draft) labels Feb 1, 2020
@jimschubert
Copy link
Member

I've merged the linked pre-req PRs. This should be good to merge after master builds pass.

@jimschubert jimschubert merged commit 8d8c106 into OpenAPITools:master Feb 1, 2020
@jimschubert jimschubert added this to the 4.3.0 milestone Feb 1, 2020
@sebastien-rosset sebastien-rosset deleted the golang-http-signature branch May 23, 2020 19:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bleeding Edge Experimental features (e.g. non-standard spec, "futures", or IETF draft) Client: Go Enhancement: Feature
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants