We have an existing API where third parties can transfer data. The API call ends with HMAC, using the same scheme as in the Ruby ApiAuth library that I use to validate signed requests. Now we need to support the download of multipart / form-data files.
I am trying to write a bash script as an example of an API call using cURL. I already have one that works without downloading files (POST request only with JSON data).
The part I'm stuck on generates $ content_md5 for a multidisciplinary request. I understand that the content of a multi-page request has sections of content separated by a boundary line, as described here.
Problem 1: cURL generates its own border line and adds it to the content header header. Problem 2: Should MD5 use the entire request body with boundary lines and section headers?
So basically, I need to know what a boundary line is so that I can generate a line that looks like sections of content and borders described in http multipart format, lines 7 through 23 so that I can MD5.
Is there a way to do this with cURL only? Is there a better way to create such a multi-component HMAC request?
I was hoping to do this with cURL, to present as a generalized example to third-party developers who will integrate with our API so that they can sign their requests in any language that they use.