fix(signing): idna-normalize hosts in etld+1 binding

[KonstantinMirin]

Fixes #988.

Independent of the signing stack (#980/#985/#987/#993) — branched off main, touches no file any of them touch.

What was wrong

etld.host_from applied no IDNA conversion, so same_registrable_domain — the eTLD+1 gate the brand-authorization binding runs on — returned False when the two sides spelled the same IDN host differently. A brand publishing brand.json under a U-label host and listing its agent under the A-label form (or the reverse) failed the binding.

It was also asymmetric with itself: the URL branch never stripped the trailing FQDN dot despite the docstring claiming it did, so host_from("https://Example.COM./") → "example.com." while host_from("Example.COM.") → "example.com".

Measured before / after:

registrable_domain("straße.de")                                  "straße.de"   -> "xn--strae-oqa.de"
same_registrable_domain("https://shop.straße.de/", "xn--strae-oqa.de")  False  -> True
host_from("https://Example.COM./")                               "example.com." -> "example.com"

How

Both branches of host_from now delegate to _idna_canonicalize.canonicalize_host — the helper #777 established and that jwks, revocation_fetcher, key_origins and ip_pinned_transport already use. This finishes that migration rather than forking it; etld.py was simply missed in the original pass. No new normalizer: the change deletes hand-rolled logic rather than adding a seventh implementation to a tree that already had six.

The fail-open vs fail-closed decision

canonicalize_host raises on underscore hosts, labels over 63 bytes, and leading hyphens, where host_from previously passed them through. The existing callers are split — jwks and revocation_fetcher fail closed, ip_pinned_transport and key_origins fail open — so "match the convention" was not available as an answer.

This fails closed: registrable_domain already documents a None contract for unusable input, and a binding gate that cannot canonicalize a host should refuse to bind rather than guess. idna.IDNAError subclasses UnicodeError subclasses ValueError, so brand_authz.py:207's existing except ValueError still catches it — an IDNA-invalid brand_domain degrades to reason="brand_domain_invalid" instead of escaping mid-verification. The reasoning is in the module docstring and the commit message, as #988 asked.

Adopter-visible changes

• registrable_domain returns A-labels for IDN input (xn--strae-oqa.de, not straße.de).
• host_from now raises for hosts IDNA cannot process; registrable_domain maps that to None.
• UTS-46 folding means compatibility forms now compare equal — same_registrable_domain("ｅｘａｍｐｌｅ.ｃｏｍ", "example.com") is now True. Correct IDNA behaviour and consistent with how DNS resolves it, but it is a widening beyond the U-label/A-label case the issue described, so calling it out explicitly.

Test plan

tests/conformance/signing/test_etld.py, new. 7 of its 10 tests fail against the pre-fix module — verified by copying the test file alone onto the merge base and running it, not by reasoning. The other three are deliberate regression fences (empty/dot-only still raise; IP literals still return None).

The tests use .de rather than .example, because .example is not in the public suffix list and an eTLD+1 assertion against it would pass vacuously.

Full suite on the branch: 5906 passed, 41 skipped, 1 xfailed. ruff, ruff format and mypy clean.

Not done here

#988 mentions adagents._idna_ascii_host as a candidate for deletion. Left alone deliberately — its claimed divergences turned out to be unreachable (whitespace is stripped upstream, _check_safe_host runs first, and idna.encode already defaults transitional=False), so removing it is a cleanup with no behaviour change and belongs in its own PR.

[aao-ipr-bot]

⚠️ Argus review could not complete

The automated review encountered an issue (possibly reached max turns, timed out, or failed to post the final gh pr review). A human reviewer should take this PR.

View workflow run

_{This is an automated message from the Argus AI review workflow.}

[bokelley]

Reviewed against current main. The shared IDNA canonicalizer makes U-label/A-label eTLD+1 comparisons converge while preserving the fail-closed behavior for invalid hosts. Focused integration coverage passed.