feat(signing): IP-pinned httpx transport closes DNS-rebinding TOCTOU

pyproject.toml

@@ -27,6 +27,14 @@ classifiers = [
 
 dependencies = [
     "httpx>=0.24.0",
+    # httpcore is a transitive dep of httpx, but we import from it
+    # directly (``adcp.signing.ip_pinned_transport`` subclasses
+    # ``SyncBackend`` / ``AnyIOBackend`` from ``httpcore._backends.*``).
+    # Pin the major so a breaking upgrade fails at install rather than
+    # at runtime. The contract test in
+    # ``tests/conformance/signing/test_ip_pinned_transport_contract.py``
+    # guards the specific API shapes we rely on.
+    "httpcore>=1.0,<2.0",
     "pydantic>=2.0.0",
     "typing-extensions>=4.5.0",
     "a2a-sdk>=0.3.0",

src/adcp/signing/__init__.py

@@ -40,6 +40,19 @@
   revocation list from ``{issuer}/.well-known/governance-revocations.json``
 * Async variants: :class:`AsyncCachingJwksResolver`,
   :class:`AsyncCachingRevocationChecker`
+
+**Custom fetchers** (rolling your own JWKS / revocation transport):
+
+* :func:`build_ip_pinned_transport` /
+  :func:`build_async_ip_pinned_transport` — returns an
+  :class:`httpx.HTTPTransport` wired to resolve the URI's host once
+  (with SSRF validation) and pin subsequent connects to that IP.
+  Closes the DNS-rebinding TOCTOU for anything built on
+  :class:`httpx.Client`.
+* :func:`resolve_and_validate_host` — returns ``(host, ip, port)``;
+  same SSRF rules as :func:`validate_jwks_uri`. Use this if you're
+  wiring your own transport and only need the resolved + validated
+  IP.
 """
 
 from __future__ import annotations
@@ -101,6 +114,13 @@
     REQUEST_SIGNATURE_WINDOW_INVALID,
     SignatureVerificationError,
 )
+from adcp.signing.ip_pinned_transport import (
+    AsyncIpPinnedTransport,
+    IpPinnedTransport,
+    abuild_ip_pinned_transport,
+    build_async_ip_pinned_transport,
+    build_ip_pinned_transport,
+)
 from adcp.signing.jwks import (
     AsyncCachingJwksResolver,
     AsyncJwksFetcher,
@@ -112,6 +132,7 @@
     as_async_resolver,
     async_default_jwks_fetcher,
     default_jwks_fetcher,
+    resolve_and_validate_host,
     validate_jwks_uri,
 )
 from adcp.signing.jws import (
@@ -187,6 +208,7 @@ def __init__(self, *args: object, **kwargs: object) -> None:
     "ALLOWED_ALGS",
     "AsyncCachingJwksResolver",
     "AsyncCachingRevocationChecker",
+    "AsyncIpPinnedTransport",
     "AsyncJwksFetcher",
     "AsyncJwksResolver",
     "AsyncRevocationListFetcher",
@@ -198,6 +220,7 @@ def __init__(self, *args: object, **kwargs: object) -> None:
     "DEFAULT_TAG",
     "FetchResult",
     "InMemoryReplayStore",
+    "IpPinnedTransport",
     "JwksResolver",
     "JwsError",
     "JwsMalformedError",
@@ -244,13 +267,16 @@ def __init__(self, *args: object, **kwargs: object) -> None:
     "VerifierCapability",
     "VerifyOptions",
     "alg_for_jwk",
+    "abuild_ip_pinned_transport",
     "as_async_resolver",
     "async_default_jwks_fetcher",
     "async_default_revocation_list_fetcher",
     "averify_detached_jws",
     "averify_jws_document",
     "b64url_decode",
     "b64url_encode",
+    "build_async_ip_pinned_transport",
+    "build_ip_pinned_transport",
     "build_signature_base",
     "canonicalize_authority",
     "canonicalize_target_uri",
@@ -265,6 +291,7 @@ def __init__(self, *args: object, **kwargs: object) -> None:
     "parse_signature_input_header",
     "private_key_from_jwk",
     "public_key_from_jwk",
+    "resolve_and_validate_host",
     "sign_request",
     "sign_signature_base",
     "unauthorized_response_headers",