Notices by mradcliffe (mradcliffe (he/him)@nokoto.org)

@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include alg parameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assume rsa-v1_5-sha256 if it’s missing. I know that’s not great, but maybe we should all just agree to include alg?

I guess @Edent feels the same way.

IMO embedded activity doesn't make sense. It is not my activity, so even if I embed it, the recipient must ignore the value because it can not be trusted.

@silverpill @julian I think the value can be trusted because object.id (and object.actor and object.object) can be looked up by the instance that sent the Follow to confirm that it was valid.

Also thanks for pointing this out because I didn't implement handling Accept activities with object as a URI myself, and will do so.

@gabboman I decided to hack on this the past few nights, and came up with an experimental, backwards-compatible implementation that I created a draft pull request for @peertube/http-signature. I tried to follow the library’s coding style of the original as much as possible.

The idea of backwards-compatibility is that you can drop this into an existing application and nothing will break. There are deprecation messages that may surface in logs to guide changing from using the function exports to the cavage12Draft export (and the rfc9421 export).

I think the next step for anyone would be:

• manual...

When last I left off, I made a pull request to peertube/http-signature library try to help the JavaScript ecosystem reach RFC 9421 parity while being backwards-compatible with cavage-12 draft implementations. There has not been any traction on this yet. Maybe because PeerTube has abandoned its own use of the library.

So our current ecosystem state is the following:

• PeerTube uses misskey-dev/node-http-message-signatures library and owns the defacto unmaintained peertube/http-signature library.
• Misskey and the rest of the ‘keyverse use peertube/http-signature library and Misskey owns the defacto...

@silverpill It should, but it isn’t node.js based.

I wanted to help the node.js ecosystem by making peertube/http-signature backwards-compatible for both draft and RFC-9421.

Although I apologize that I am requiring alg.

@evan @julian@fietkau.social @julian@activitypub.space  I think organizing a contribution event to refactor @peertube/http-signature and golang’s httpsig or gotosocial's fork of httpsig to support both cavage-12 and RFC9421 would go a long way to getting this done sooner as most of the software missing implementation depend on those libraries.

If I do need to wrap it an Announce, then I think I will need to do the following based on how it works on my end.

1. Create my post as normal, but don’t address it to the community initially.
2. Announce my own post making sure I address it to the community.

I guess that might show up as me boosting my own post on some instances (tooting my own horn? Horning my own toot?), which I would feel ashamed of.

Sorry, to clarify, I meant mastodon.social is now verifying signatures from remote instances that sign using RFC 9421, @silverpill.

Signing requests is still pending. Unfortunately that seems to have slipped from 4.5.

I configured a debug log to check whether my signature is verified using RFC 9421. So far, Mastodon (for instances that turned the feature on), WordPress and Mitra :-). 

Oh, nice! Congrats to mastodon.social for turning on RFC 9421 signature verification. 🎉

@evan So I should plant seeds so I can watch them wither and die like my hopes when I forget to water them regularly? I have the opposite of green thumbs.

I did plant some peppers in a pot today. Hopefully the squirrels, rabbits, or birds don’t eat them.

fetch can be used without CORS setting mode to "no-cors", which should work for a GET, but may get rejected by the server, @evan.

I'm sorry I have not gotten back to you yet, @evan. After posting that, I broke my implementation as one does when one is new to this stuff. :P

I'll try to look over the GitHub issue, but I am new to this so I think I need to buy your book too when I have a chance. :D

I read this over the weekend and started implementing it since it isn't too difficult, @evan.

I was able to implement the WebFinger discovery and add some "alternate" anchor elements to pages on my blog and my profile. Since some of my content is aliased, I used the aliases property to add an alias as well.