docs(signatures): make example signature values raw r||s as the spec requires#590
Open
vishkaty wants to merge 2 commits into
Open
docs(signatures): make example signature values raw r||s as the spec requires#590vishkaty wants to merge 2 commits into
vishkaty wants to merge 2 commits into
Conversation
…requires
signatures.md mandates fixed-width raw r||s encoding for ECDSA signature
values ("MUST use fixed-width raw r||s encoding"), but the worked examples
showed values beginning ME[UQ]C... — the base64 of a DER SEQUENCE, the exact
encoding the normative text forbids. An implementer copying the examples'
shape produces signatures a conformant verifier rejects.
Replaces the seven example values in signatures.md, checkout-mcp.md,
checkout-rest.md, and order-rest.md with a genuine ES256 raw r||s value
(64 bytes, 88 base64 chars), preserving each instance's truncation style.
The instance in order.md is deliberately left to avoid overlapping Universal-Commerce-Protocol#568,
which edits the same example block.
Fixes Universal-Commerce-Protocol#569.
damaz91
added
status:needs-triage
Contributor
|
Thanks for this documentation fix @vishkaty ! I see there are others examples fix worthy, like
Can you take a look and add them in this PR? |
damaz91
self-requested a review
July 16, 2026 09:13
…alues Extends the sweep per review: the response-signing examples used a second DER shape (MFQCIH..., a 0x30-led SEQUENCE) that the first pass's pattern missed — now swept by decoding every example signature value's leading byte rather than pattern-matching. Fixes checkout-mcp.md, checkout-rest.md, and signatures.md's response-signing example, and aligns the stale keyid="merchant-2025" with the merchant-2026 used by every sibling example. order.md's instance remains deferred to avoid overlapping Universal-Commerce-Protocol#568.
Contributor
Author
|
Good catch — thank you! Both fixed, plus one more the first pass missed: those response-signing examples use a second DER shape ( The only DER-shaped value now remaining anywhere in docs/ is order.md's — left deliberately since #568 edits that same example block; it can pick up the value fix on whichever lands second. |
damaz91
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #569: signatures.md mandates fixed-width raw
r||sencoding for ECDSA signature values, but the worked examples show values beginningMEUC…/MEQC…— the base64 of a DERSEQUENCE, the exact encoding the normative text forbids (§ Signature value encoding). An implementer copying the examples' shape produces signatures a conformant verifier rejects.What changed
Replaces the seven example signature values across
signatures.md(4),checkout-mcp.md(1),checkout-rest.md(1), andorder-rest.md(1) with a genuine ES256 rawr||svalue (a real P-256 signature: 64 bytes → 88 base64 chars, decodes to no ASN.1 structure), preserving each instance's truncation style (…).The eighth instance, in
order.md, is deliberately not touched here — #568 edits the same example block (addingucp-agentto its covered components), and overlapping diffs would conflict; it can pick up the value fix on whichever lands second.Example values only; no normative text changes.