InvalidSignature now holds hmac::digest::MacError via #[from], letting
thiserror derive the From impl rather than writing it manually.
Also unpins hex from 0.4.3 to * to match the rest of the deps.

https://claude.ai/code/session_01YXVu67hVnQSAY8wzmfmRHw

diff --git a/quire-ci/Cargo.toml b/quire-ci/Cargo.toml
index 6e2abb7..4281481 100644
--- a/quire-ci/Cargo.toml
+++ b/quire-ci/Cargo.toml
@@ -32,7 +32,7 @@ tracing = { workspace = true }
 tracing-opentelemetry = { workspace = true }
 tracing-subscriber = { workspace = true }
 uuid = { version = "*", features = ["v7"] }
-hex = "0.4.3"
+hex = "*"
 
 [dev-dependencies]
 http-body-util = "*"
diff --git a/quire-ci/src/server.rs b/quire-ci/src/server.rs
index 7434738..812bf64 100644
--- a/quire-ci/src/server.rs
+++ b/quire-ci/src/server.rs
@@ -32,23 +32,17 @@ enum WebhookError {
     #[error("missing or malformed Authorization header")]
     MissingSignature,
     #[error("signature mismatch")]
-    InvalidSignature,
+    InvalidSignature(#[from] hmac::digest::MacError),
     #[error(transparent)]
     InvalidPayload(#[from] serde_json::Error),
     #[error(transparent)]
     Db(#[from] rusqlite::Error),
 }
 
-impl From<hmac::digest::MacError> for WebhookError {
-    fn from(_: hmac::digest::MacError) -> Self {
-        Self::InvalidSignature
-    }
-}
-
 impl IntoResponse for WebhookError {
     fn into_response(self) -> axum::response::Response {
         match self {
-            WebhookError::MissingSignature | WebhookError::InvalidSignature => {
+            WebhookError::MissingSignature | WebhookError::InvalidSignature(_) => {
                 StatusCode::UNAUTHORIZED
             }
             WebhookError::InvalidPayload(_) => StatusCode::BAD_REQUEST,