Bug Report

In algorithms.go:214, rsaAlgorithm.Sign() unconditionally type-asserts the signer to ssh.AlgorithmSigner without a safety check:

// algorithms.go:214
sshsig, err = r.sshSigner.(ssh.AlgorithmSigner).SignWithAlgorithm(rand, sig, ssh.SigAlgoRSASHA2256)

If the signer passed in does not implement ssh.AlgorithmSigner, this panics at runtime instead of returning an error.

Stacktrace

panic: interface conversion: *gitea.HTTPSign is not ssh.AlgorithmSigner: missing method SignWithAlgorithm

goroutine 1 [running]:
github.com/42wim/httpsig.(*rsaAlgorithm).Sign(...)
        github.com/42wim/httpsig@v1.2.4/algorithms.go:214 +0x2d0

Suggested Fix

if as, ok := r.sshSigner.(ssh.AlgorithmSigner); ok {
    sshsig, err = as.SignWithAlgorithm(rand, sig, ssh.SigAlgoRSASHA2256)
} else {
    return nil, fmt.Errorf("signer does not implement ssh.AlgorithmSigner")
}

Context

https://gitea.com/gitea/go-sdk/issues/780
https://gitea.com/gitea/go-sdk/pulls/781

Discovered via gitea/go-sdk#781, where HTTPSign wraps ssh.Signer but does not implement ssh.AlgorithmSigner. Any similar wrapper will hit this panic.