Function signing_input 

pub fn signing_input(
    caller: &str,
    callee: &str,
    method: &str,
    path: &str,
    contract: &str,
    wire: &str,
    timestamp: &str,
    body_sha256_hex: &str,
) -> String

I2 (#1971): the bytes a request’s signature is computed over. One field per line, \n-separated, no trailing newline:

1. SIGNING_SCHEME;
2. the caller, as sent in CALLER_HEADER;
3. the callee’s qualified context name, so a signature verifies at one callee only;
4. the method;
5. the URL’s pathname exactly as sent, with no query string and no percent-normalisation;
6. CONTRACT_HEADER as sent, empty when absent;
7. WIRE_HEADER as sent, 1 when absent, so the version a callee decodes under is the one that was signed;
8. TIMESTAMP_HEADER as sent;
9. the SHA-256 of the body’s bytes, 64 lowercase hex digits.

Every header the callee acts on is in it. Header values cannot hold a newline, so no field can forge another’s line.