Conversation

Notices

1. Embed this notice
   PuercoPop (puercopop@mastodon.social)'s status on Thursday, 18-Jun-2026 23:40:53 JST PuercoPop

   Question about HTTP Signatures in #ActivityPub, IIUC the header is a digest of the HTTP body. Given that JSON is not white-space sensitive, does that mean that storing the response must preserve the indentation used by the server?

   #ActivityPubDev

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Thursday, 18-Jun-2026 23:40:52 JST silverpill

     in reply to

     @PuercoPop Yes, but why do you want to store the response? HTTP signatures are not supposed to be re-used.

   • Embed this notice
     PuercoPop (puercopop@mastodon.social)'s status on Friday, 19-Jun-2026 05:06:04 JST PuercoPop

     in reply to

     • silverpill

     @silverpill Sorry for being imprecise, I meant the response as the response body, not the entire HTTP response. I'm wondering if having white-space sensitive JSON means one can't use JSONB to store the response.

     What I'm trying to understand is if the HTTP signature is useful to provide a way for users/clients to verify the integrity of the activity, similar to how sha256.sum is used in software distribution.

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Friday, 19-Jun-2026 05:06:04 JST silverpill

     in reply to

     @PuercoPop I think HTTP signatures are not good for that, but you can put a signature inside an activity:

     https://fediverse.codeberg.page/fep/fep/8b32/

     "integrity proofs" proposed in this document use JSON Canonicalization Scheme, which is not whitespace-sensitive.