http-sig: Update http message signatures for OCM after spec review

[mickenordin]

Summary

This pr adjust the format of HTTP Message Signatures following the review of OCM that resulted in some modifications to OCM spec: cs3org/OCM-API#391

1. Date is no longer signed, some intermediaries sometimes rewrite the date header, causing the signature to fail. Since we already sign created it is fine.
2. We switch to using an ocm tag rather than a label. This is because a label is simply a key, where as the tag is signed.
3. We add the jwksUri to the discovery, since RFC7517 does not in fact standardize .well-known/jwks.json. I left the actual endpoint there, but i can be moved in the future if we want, as long as the discovery is updated along with it.
4. Key algorithm discovery is done via the alg parameter in the jwks.
5. Require the keyid signature parameter.

I also updated annotations since, because the original httpsig PR was not merge before NC34 was released, so it needed some updates.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI

Manual testing:

This request:

{
    "shareWith": "bob@https://bob.ocm.drive.test.sunet.se",
    "shareType": "user",
    "name": "2026-07-07T11:38:03,169846023+02:00.png",
    "resourceType": "file",
    "description": "",
    "providerId": "48",
    "owner": "alice@alice.ocm.drive.test.sunet.se",
    "ownerDisplayName": "alice",
    "sharedBy": "alice@alice.ocm.drive.test.sunet.se",
    "sharedByDisplayName": "alice",
    "sender": "alice@alice.ocm.drive.test.sunet.se",
    "senderDisplayName": "alice",
    "protocol": {
        "name": "webdav",
        "webdav": {
            "uri": "https://https://bob.ocm.drive.test.sunet.se/public.php/webdav/",
            "sharedSecret": "WB7i0NLgWFB6t2D65g7ATtW9QK1uwVRA",
            "permissions": [
                "{http://open-cloud-mesh.org/ns}share-permissions"
            ]
        }
    }
}

Has the headers:

POST https://bob.ocm.drive.test.sunet.se/index.php/ocm/shares HTTP/2.0
content-type: application/json
content-digest: sha-256=:ylqyzlJCuqc3YDhViVz61MWy6XGxYRDuSn4QfuMnc/Y=:
date: Sun, 26 Jul 2026 13:07:20 GMT
signature-input: ocm=("@method" "@target-uri" "content-digest" "content-length");created=1785071240;keyid="https://alice.ocm.drive.test.sunet.se/ocm#ecdsa-p256-sha256-1";tag="ocm"
signature: ocm=:H0JNrxoe6E61CKUtvbixpdzYdyr06sIpbS03H4ENtV7T5KblumxuZyvA5x4vSoMbcxugnX/8M2fiNKEmKeAAHg==:
user-agent: Nextcloud-Server-Crawler/35.0.0 dev
accept-encoding: br, gzip
content-length: 647

This is between two servers (alice and bob) that support the RFC9421 signatures.

Between a server that supports both, and a server with only draft-cavage support (alice and charlie) it looks like this for the body:

{
    "shareWith": "charlie@https://charlie.ocm.drive.test.sunet.se",
    "shareType": "user",
    "name": "welcome.txt",
    "resourceType": "file",
    "description": "",
    "providerId": "49",
    "owner": "alice@alice.ocm.drive.test.sunet.se",
    "ownerDisplayName": "alice",
    "sharedBy": "alice@alice.ocm.drive.test.sunet.se",
    "sharedByDisplayName": "alice",
    "sender": "alice@alice.ocm.drive.test.sunet.se",
    "senderDisplayName": "alice",
    "protocol": {
        "name": "webdav",
        "options": {
            "sharedSecret": "UzJ7vrrKNycDa2fDlyOlFGWopsRnEPr8",
            "permissions": "{http://open-cloud-mesh.org/ns}share-permissions"
        }
    }
}

headers:

POST https://charlie.ocm.drive.test.sunet.se/ocm/shares HTTP/2.0
content-type: application/json
date: Sun, 26 Jul 2026 13:14:04 GMT
digest: SHA-512=QMy9wsI/MzJJ15HouiFG0VvdgjTkYl3GUAZ0k6ZGyA6RzgdI2v6i+IFHeNRj9BDpfxl5r40MgVXE5Ha5DwmrsA==
signature: keyId="https://alice.ocm.drive.test.sunet.se/ocm#signature",algorithm="rsa-sha512",headers="(request-target) content-length date digest host",signature="u0QffxZWI6mtXEQUyGrjoE0SZDzNO3YFhKyKq46ewsSFqpAtrZzSqhJUHeNU4dVjAC09umFrvY74XN9dif14bmaMf6ps9lF5VweE+LVAk/FS7BmbqJ5nSSkxyc2ZHwcoDH6GbLJk7vg4PMSWxZpJvyk67vZ+RwH58GLi1n/1Vqcl8XyCrgjYXNer+zHS5Fzzy4gllM0QsLglKsKfv0pf/sfpUXkO9wa2aDo0tbDCLql4EuvGC7lyg8Fbn0kgpjrezimtuvzPeZ0BE/I2RGr6vPfebA8Y9fhAn6Fuzge8pviDsoC+2wQJUrMx3ZdDXMRTm3RvsOMUtpLzA0L6UYDYjg=="
user-agent: Nextcloud-Server-Crawler/35.0.0 dev
accept-encoding: br, gzip
content-length: 548

And for charlie to bob:

{
    "shareWith": "bob@https://bob.ocm.drive.test.sunet.se",
    "shareType": "user",
    "name": "Readme.md",
    "resourceType": "file",
    "description": "",
    "providerId": "6",
    "owner": "charlie@charlie.ocm.drive.test.sunet.se",
    "ownerDisplayName": "charlie",
    "sharedBy": "charlie@charlie.ocm.drive.test.sunet.se",
    "sharedByDisplayName": "charlie",
    "sender": "charlie@charlie.ocm.drive.test.sunet.se",
    "senderDisplayName": "charlie",
    "protocol": {
        "name": "webdav",
        "options": {
            "sharedSecret": "FxnX4J6ZNMA3yUk",
            "permissions": "{http://open-cloud-mesh.org/ns}share-permissions"
        }
    }
}

with headers:

POST https://bob.ocm.drive.test.sunet.se/index.php/ocm/shares HTTP/2.0
content-type: application/json
date: Sun, 26 Jul 2026 13:17:21 GMT
digest: SHA-512=y5569iwDkc2FgiwPe/feC77ohzncy2NDpxcRAuZBjD2EETR7bH1l4EYtlCL7BxFiqE3q2gGVeuKaKWVqLVKTwQ==
signature: keyId="https://charlie.ocm.drive.test.sunet.se/ocm#signature",algorithm="rsa-sha512",headers="(request-target) content-length date digest host",signature="MgP+5oEV0+qAx1UiWWodQUSSkYDDyCgZJ+5EZPZOMtHj9c9TTR2xwbNuoWtzTf2TVq/HcQ9XZAS3TA6/ZF7DIhVG20/Em63UeTVNvUREojibxCRRB/IMBl5IUxve4swk7F1jnqUWINMi2MKd8igYdk1cESzLzQXC/GUL5CraYrKO1Ke8tG2MBzpjQWQ4o/53yjt93XKW+KC3dbx9LN5tq5U583z6RajwfdUt95uK0aRPDoJXRTU1satAryRRKmx0XYC7W/Aztpo6l6YEVAP0a33doEEDF6SpmwZHXJcoYM90AXcS/xxfY5YBudgUms2Alls8in0NXVFhn0EUR46a3A=="
user-agent: Nextcloud-Server-Crawler/33.0.3
accept-encoding: gzip
content-length: 538

Functionally the pr works, and is backwards compatible. It may break between servers running on an unpatched master and a patched master, but that is not a too big concern I think since the code it changes is not yet in any release.

[Antreesy]

Sorry, tapped the wrong button

[nickvergessen]

Sharing textfile0.txt failed, could not find group1@http://localhost:8180, maybe the server is currently unreachable or uses a self-signed certificate.

Seems this is breaking HTTP (without S) which can be used in real world, but is especially used in all tests (also in other apps outside of server)