寻求基于signParams与signature的REST内容签名实现方案

我正在为Home Assistant开发集成，需要复刻某应用的交互逻辑。目前已通过HTTPS完成与服务器的认证和通信，但部分接口要求对数据进行签名。

通过协议抓包获取到以下相关数据：

appProjectName: fop4lite
appVersion:     1.5.0
clientDate:     2022-06-19
lang:           en
language:       en
pageNo:         1
pageSize:       100
passKey:        1A9E769E-F67C-4243-BB42-7D1CE2CCF614
platform:       iOS
signParams:     appVersion,clientDate,lang,pageNo,pageSize,passKey,platform,timeStamp,token
signature:      B619F120519488AD00A0C760546038356ABD69D9
timeStamp:      1655623282899
token:          D247E1771E4A6323011E330353BA4C26EC1A

从表面看，signature是基于signParams中参数生成的SHA1哈希值。我怀疑数据签名时使用了未知的盐值，但无法获取该信息。已向服务提供商求助，但由于这是非公开API，对方大概率不会提供支持。因此希望获取实现该签名的思路和指导。

我编写了以下Python脚本，尝试通过试错法分析签名的生成方式：

import hashlib
import urllib
import urllib.parse
import hmac
import base64

data = {            
    "appProjectName": "fop4lite",
    "appVersion": "1.5.0",
    "clientDate": "2022-06-19",
    "lang": "en",
    "language": "en",
    "pageNo": "1",
    "pageSize": "100",
    "passKey": "1A9E769E-F67C-4243-BB42-7D1CE2CCF614",
    "platform": "iOS",
    "signParams": "appVersion,clientDate,lang,pageNo,pageSize,passKey,platform,timeStamp,token",
    "signature": "B619F120519488AD00A0C760546038356ABD69D9",
    "timeStamp": "1655623282899",
    "token": "D247E1771E4A6323011E330353BA4C26EC1A",
    }

sign_data_tuple = (
    data['appVersion'], 
    data['clientDate'], 
    data['lang'], 
    data['pageNo'], 
    data['pageSize'], 
    data['passKey'], 
    data['platform'], 
    data['timeStamp'],
    data['token'],
    )

sign_data_dict = {
    "appVersion" : data['appVersion'], 
    "clientDate" : data['clientDate'], 
    "lang" : data['lang'], 
    "pageNo" : data['pageNo'], 
    "pageSize" : data['pageSize'], 
    "passKey" : data['passKey'], 
    "platform" : data['platform'], 
    "timeStamp" : data['timeStamp'],
    "token" : data['token'],
    }

def test_enc(my_data):
    my_hash = hashlib.sha1(my_data.encode()).hexdigest().upper()
    print("STR: ", my_data)
    if data['signature'] == my_hash:
        print("SUCCESS")
    else:
        print("FAIL")
        print("SIG: ", data['signature'])
        print("TST: ", my_hash, "\n")


test_enc(",".join(sign_data_tuple))
test_enc(",".join(sign_data_tuple)+",")
test_enc(", ".join(sign_data_tuple))
test_enc(", ".join(sign_data_tuple)+", ")
test_enc(urllib.parse.urlencode(sign_data_dict))

脚本输出如下：

STR:  1.5.0,2022-06-19,en,1,100,1A9E769E-F67C-4243-BB42-7D1CE2CCF614,iOS,1655623282899,D247E1771E4A6323011E330353BA4C26EC1A
FAIL
SIG:  B619F120519488AD00A0C760546038356ABD69D9
TST:  D24688B6E3766E84D1DD16667C55D66315189D16

STR:  1.5.0,2022-06-19,en,1,100,1A9E769E-F67C-4243-BB42-7D1CE2CCF614,iOS,1655623282899,D247E1771E4A6323011E330353BA4C26EC1A,
FAIL
SIG:  B619F120519488AD00A0C760546038356ABD69D9
TST:  CAD390C2FBF0AE1B8A04EDF045DE2797E18D06E8

STR:  1.5.0, 2022-06-19, en, 1, 100, 1A9E769E-F67C-4243-BB42-7D1CE2CCF614, iOS, 1655623282899, D247E1771E4A6323011E330353BA4C26EC1A
FAIL
SIG:  B619F120519488AD00A0C760546038356ABD69D9
TST:  57C1499F38D2547B8AB737B5221FFC64C1741DCD

STR:  1.5.0, 2022-06-19, en, 1, 100, 1A9E769E-F67C-4243-BB42-7D1CE2CCF614, iOS, 1655623282899, D247E1771E4A6323011E330353BA4C26EC1A,
FAIL
SIG:  B619F120519488AD00A0C760546038356ABD69D9
TST:  DB8C0996D1C86ABDFAE21B0B9CE3396374EB681B

STR:  appVersion=1.5.0&clientDate=2022-06-19&lang=en&pageNo=1&pageSize=100&passKey=1A9E769E-F67C-4243-BB42-7D1CE2CCF614&platform=iOS&timeStamp=1655623282899&token=D247E1771E4A6323011E330353BA4C26EC1A
FAIL
SIG:  B619F120519488AD00A0C760546038356ABD69D9
TST:  64E1FE858566AF375E5B00198F0ADA9624CA1609

目前已无其他思路，希望获得相关的技术指引和建议。

内容的提问来源于stack exchange，提问作者Marcus