Can parameterised identifiers in Signature header have extra parameter?

[tomokinat]

According to https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#signature-header, each parameterised identifier MUST have parameters 'sig', 'integirty', and so on. Then is it okay for them to contain other parameters not referred as 'necessary' in the spec?

[jyasskin]

The spec currently says it's allowed.

Another reasonable point in the design space would be to say that a particular parameterised identifier from the list is only valid in this version of the specification if it has exactly the set of parameters required or explicitly allowed in this version of the spec. Then future evolution could work by adding extra elements to the list instead of adding extra parameters to elements that might be interpreted by old implementations.

The current design for evolving the spec, which is currently only implemented as the application/signed-exchange format, is to increment the overall version number and rely on content negotiation to pick the right file, which doesn't need an extension point here at all. However, there's some interest in making the format a little more extensible than that, so we should come back to this when we think that through.