洪 民憙 (Hong Minhee)
I received a request from @ghost today to add #LDSignatures to @fedify for compatibility with #Mastodon, as Mastodon does not plan to implement Object Integrity Proofs (FEP-8b32) for the near future. 😩
However, Mastodon's implementation of LD Signatures does not even use valid JSON-LD properties (despite the name), so I'm not sure how to make it compatible with Mastodon since #Fedify does JSON-LD processing. 🤔
Emelia 👸🏻
@andypiper @liaizon @hongminhee the version of JSON-LD Signatures that mastodon supports is old, basically they implemented it, then the spec completely changed.
That's why stuff doesn't look right.
The question is then: how do you migrate forwards without breaking compatibility with existing deployments. That's gonna need time & money thrown at the problem to solve.
silverpill
@thisismissem @liaizon @andypiper @hongminhee
FEP-8b32 is designed to be compatible with existing implementations. The upgrade path for Mastodon may look like this:
1. Support multiple public keys per actor
2. Start publishing second Ed25519 key as described in FEP-521a
3. Start adding FEP-8b32 integrity proofs in addition to LD signatures (as specified in "Backward compatibility" section of FEP-8b32)
4. Stop adding LD signatures
Andy Piper ➡️ EMF 📞 ANDYP
@liaizon @hongminhee @thisismissem I think it may be something long-standing here, is there an existing GitHub issue where I can get more background? I know it’s pretty complicated at this point though.
Andy Piper ➡️ EMF 📞 ANDYP
@liaizon @hongminhee @thisismissem (also asking as I’m on my phone walking right now and can’t search so easily!)
洪 民憙 (Hong Minhee)
As the creator of Fedify, I'd like to see either ActivityPub implementations all deal with JSON-LD properly, or the ActivityPub spec gives up on JSON-LD. 😩
wakest ⁂
@hongminhee hey @thisismissem, @andypiper what do yall think of this situation? where are we going here? I keep seeing dev after dev complain about the JSON-LD issue with Mastodon and I personally dont even know where to stand on it but it seems its a major hurdle.
silverpill
@hongminhee Do they want LD signatures in Fedify in order to process forwarded Create activities? I simply fetch object by its id when signer and actor do no match.
Rimu
@hongminhee Here is some code for verifying and creating LD Signatures https://codeberg.org/rimu/pyfedi/src/commit/1a658d007fa6259ea736005b818ae516a954bb16/app/activitypub/signature.py#L429
I tested it out last week but haven't used it in production - this was originally copied from Takahe so I assume it works well with Mastodon.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.