Update http signatures to new draft rfc

[damooo]

Http signatures draft 19 has many significant changes and additions from 12. It would be great, if the picky is compatible.

[damooo]

It seems whole new spec though.

[CBenoit]

Thank you for the issue! FYI, I don’t think we’ll be working on this anytime soon because our product which was using HTTP signatures has been discontinued and we don’t have anything relying on this anymore. We may need HTTP signatures again in the future, but I’m not sure yet. If someone is interested into implementing the new version of the spec, I would gladly accept a PR for that. Otherwise, we may remove HTTP signatures from picky in the future, because long-term there is not much value to keeping an outdated implementation which is not compatible with the newer spec.

[sp1ff]

Indeed, draft 19 is almost a new spec. I can verify that Mastodon is still on draft 12, and my understanding is that that is the version in use throughout the Fediverse. I opened a PR addressing a problem with version 12 compliance before reading this issue-- what is the current thinking on dropping support for HTTP signatures?

[CBenoit]

I’m fine with keeping the implementation for draft 12 as long as it’s useful – it does not represent a big maintenance burden for us. (Thank you for addressing the compliance issue, I merged it.)
If we decide to drop the draft 12 implementation, that would be in picky v8 I think. And it’s not planned yet, so feel free to continue using picky implementation. I think you’ll be fine until Fediverse/Mastodon switches to a newer draft.