search

w3c-ccg / http-signatures

Signing HTTP Messages specification
https://w3c-dvcg.github.io/http-signatures/
Other
34 stars 9 forks source link

Archiving this repository? #112

Open ioggstream opened 4 years ago

ioggstream commented 4 years ago

Hi @msporny WDYT to reference the new https://github.com/httpwg/http-extensions/blob/master/draft-ietf-httpbis-message-signatures.md for everything that is related to it?

davidlehn commented 4 years ago

Regarding the title of this issue, if you are referring to the GitHub "archiving" feature, I don't think that should be used here anytime soon. If/when the IETF spec can replace what's here, then a deprecation notice could be added. There are users of this spec and it may need updates from time to time even if a newer shiny spec becomes preferred.

liamdennehy commented 4 years ago

This spec is no longer active and formally replaced by draft-ietf-httpbis-message-signatures:

Screenshot from 2020-08-07 20-51-49

The latest version of this repository is nothing but one big notice to that effect.

To that end, @ioggstream is querying whether we should retire this entire project, including issues etc, as it is misleading to not state clearly this spec is dead, leading to assumptions that a new version might come up soon or that issues are still actively being worked on.

msporny commented 4 years ago

This spec is dead

Be careful about putting stuff like this into an issue tracker. The specification isn't dead... it lives on as draft-ietf-httpbis-message-signatures. :)

The only question is how we signal that everyone should move their engagement over there.

-1 on closing all issues as some of them still apply to the work happening at HTTP WG now.

liamdennehy commented 4 years ago

Be careful...

Moved to less harsh language, apologies

liamdennehy commented 4 years ago

The only question is how we signal that everyone should move their engagement over there.

At present the only way to discover that is to visit the tracker as I quoted above. Is there any plan to formally publish v13, and formally announce deprecation as currently stated in index.xml? My own clients using this are still blissfully unaware their implmentations are now defunct (auth scheme is gone in new spec) as it is not clearly stated anywhere else.

ioggstream commented 4 years ago

Archiving this gh-repo without closing the issues imho is the right thing to do. This is what I did when digest-headers was moved inside ietf https://github.com/ioggstream/draft-polli-resource-digests-http

I think in September I will start to work regularly on message-signatures, and having all the work there is an opportunity for everybody to achieve an RFC status and get feedbacks from folks working on similar specs.

Sorry for having created this small earthquake :)