feat(http-sig): OCM Ed25519 keys, JWKS endpoint, http-sig capability

OCM dual-stack integration of RFC 9421 alongside the existing cavage
publicKey path:

- OCMSignatoryManager: Ed25519 active/pending/retiring slot rotation
  backed by numbered pool appkeys, getRemoteKey for inbound JWK lookup
  with per-origin cache + cache-miss refetch, and getLocalEd25519Jwks
  for the JWKS endpoint.
- Rfc9421SignatoryManager: per-call wrapper that swaps in the Ed25519
  signatory and toggles `rfc9421.format`.
- OCMJwksHandler: serves /.well-known/jwks.json (RFC 7517) when signing
  is enabled.
- OCMDiscoveryService: advertises `http-sig` in capabilities when
  signing is enabled, and picks the signature scheme on outbound based
  on the remote's advertised capabilities.
- Application.php: register the JWKS well-known handler.

Signed-off-by: Micke Nordin <kano@sunet.se>

Author: mickenordin

core/AppInfo/Application.php

@@ -23,6 +23,7 @@
 use OC\Core\Listener\PasswordUpdatedListener;
 use OC\Core\Notification\CoreNotifier;
 use OC\OCM\OCMDiscoveryHandler;
+use OC\OCM\OCMJwksHandler;
 use OC\TagManager;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
@@ -88,6 +89,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerConfigLexicon(ConfigLexicon::class);
 
 		$context->registerWellKnownHandler(OCMDiscoveryHandler::class);
+		$context->registerWellKnownHandler(OCMJwksHandler::class);
 		$context->registerCapability(Capabilities::class);
 	}
 

lib/private/OCM/OCMDiscoveryService.php

@@ -199,10 +199,15 @@ public function getLocalOCMProvider(bool $fullDetails = true): IOCMProvider {
 			return $provider;
 		}
 
+		$signingEnabled = !$this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_DISABLED, lazy: true);
+
 		$provider->setEnabled(true);
 		$provider->setApiVersion(self::API_VERSION);
 		$provider->setEndPoint(substr($url, 0, $pos));
 		$provider->setCapabilities(['invite-accepted', 'notifications', 'shares']);
+		if ($signingEnabled) {
+			$provider->setCapabilities(['http-sig']);
+		}
 
 		// The inviteAcceptDialog is available from the contacts app, if this config value is set
 		$inviteAcceptDialog = $this->appConfig->getValueString('core', ConfigLexicon::OCM_INVITE_ACCEPT_DIALOG);
@@ -217,9 +222,8 @@ public function getLocalOCMProvider(bool $fullDetails = true): IOCMProvider {
 		$provider->addResourceType($resource);
 
 		if ($fullDetails) {
-			// Adding a public key to the ocm discovery
 			try {
-				if (!$this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_DISABLED, lazy: true)) {
+				if ($signingEnabled) {
 					/**
 					 * @experimental 31.0.0
 					 * @psalm-suppress UndefinedInterfaceMethod
@@ -342,31 +346,43 @@ public function requestRemoteOcmEndpoint(
 	}
 
 	/**
-	 * add entries to the payload to auth the whole request
+	 * Sign the outgoing payload using the scheme the remote advertises
+	 * (RFC 9421 if `http-sig`, else cavage if a `publicKey` is present).
+	 * APPCONFIG_SIGN_ENFORCED / APPCONFIG_SIGN_DISABLED still apply.
 	 *
 	 * @throws OCMProviderException
-	 * @return array
 	 */
 	private function prepareOcmPayload(string $uri, string $method, array $options, string $payload, bool $signed): array {
 		$payload = array_merge($this->generateRequestOptions($options), ['body' => $payload]);
 		if (!$signed) {
 			return $payload;
 		}
 
-		if ($this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_ENFORCED, lazy: true)
-			&& $this->signatoryManager->getRemoteSignatory($this->signatureManager->extractIdentityFromUri($uri)) === null) {
+		$origin = $this->signatureManager->extractIdentityFromUri($uri);
+		$ocmProvider = $this->discover($origin);
+
+		$useRfc9421 = $ocmProvider->hasCapability('http-sig');
+		$hasPublicKey = $this->signatoryManager->getRemoteSignatory($origin) !== null;
+
+		if (!$useRfc9421 && !$hasPublicKey
+			&& $this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_ENFORCED, lazy: true)) {
 			throw new OCMProviderException('remote endpoint does not support signed request');
 		}
 
-		if (!$this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_DISABLED, lazy: true)) {
-			$signedPayload = $this->signatureManager->signOutgoingRequestIClientPayload(
-				$this->signatoryManager,
-				$payload,
-				$method, $uri
-			);
+		if ($this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_DISABLED, lazy: true)) {
+			return $payload;
 		}
 
-		return $signedPayload ?? $payload;
+		$signatoryManager = $useRfc9421
+			? new Rfc9421SignatoryManager($this->signatoryManager)
+			: $this->signatoryManager;
+
+		return $this->signatureManager->signOutgoingRequestIClientPayload(
+			$signatoryManager,
+			$payload,
+			$method,
+			$uri,
+		);
 	}
 
 	private function generateRequestOptions(array $options): array {

lib/private/OCM/OCMJwksHandler.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\OCM;
+
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\Http\WellKnown\GenericResponse;
+use OCP\Http\WellKnown\IHandler;
+use OCP\Http\WellKnown\IRequestContext;
+use OCP\Http\WellKnown\IResponse;
+use OCP\IAppConfig;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/** Serves `/.well-known/jwks.json` (RFC 7517) for the RFC 9421 keys. */
+class OCMJwksHandler implements IHandler {
+	public function __construct(
+		private readonly IAppConfig $appConfig,
+		private readonly OCMSignatoryManager $signatoryManager,
+		private readonly LoggerInterface $logger,
+	) {
+	}
+
+	#[\Override]
+	public function handle(string $service, IRequestContext $context, ?IResponse $previousResponse): ?IResponse {
+		if ($service !== 'jwks.json') {
+			return $previousResponse;
+		}
+
+		$keys = [];
+		if (!$this->appConfig->getValueBool('core', OCMSignatoryManager::APPCONFIG_SIGN_DISABLED, lazy: true)) {
+			try {
+				foreach ($this->signatoryManager->getLocalEd25519Jwks() as $jwk) {
+					$keys[] = $jwk;
+				}
+			} catch (Throwable $e) {
+				$this->logger->warning('failed to build local Ed25519 JWKs', ['exception' => $e]);
+			}
+		}
+
+		return new GenericResponse(new JSONResponse(['keys' => $keys]));
+	}
+}