Use ActivityPub main key for HTTP signatures #40

Merged

erik merged 1 commit from task-d213c262-use-main-key-signature into main

2026-06-28 11:35:07 -05:00

erik commented

2026-06-28 11:32:57 -05:00

Owner

Summary

sign ActivityPub outbound HTTP delivery with the actor #main-key instead of #multikey-1
Mastodon rejected actor Update delivery with Public key not found for key ...#multikey-1
update delivery and route tests to assert the Mastodon-compatible key ID

Verification

npm run typecheck
npm test -- --run src/federation/tests/delivery.test.ts src/federation/tests/routes.test.ts
npm test
npm run build

Task: task-d213c262

After release/deploy, update the actor avatar again and verify Mastodon no longer returns 401.

## Summary - sign ActivityPub outbound HTTP delivery with the actor `#main-key` instead of `#multikey-1` - Mastodon rejected actor Update delivery with `Public key not found for key ...#multikey-1` - update delivery and route tests to assert the Mastodon-compatible key ID ## Verification - npm run typecheck - npm test -- --run src/federation/__tests__/delivery.test.ts src/federation/__tests__/routes.test.ts - npm test - npm run build Task: task-d213c262 After release/deploy, update the actor avatar again and verify Mastodon no longer returns 401.

erik added 1 commit

2026-06-28 11:32:57 -05:00

Use ActivityPub main key for HTTP signatures 49adb1e75d

erik commented

2026-06-28 11:33:15 -05:00

Author

Owner

Review summary

Approved. Production logs show Mastodon rejects actor Update delivery signed with #multikey-1 (401 Unauthorized, Public key not found). Switching HTTP signatures back to the actor #main-key matches the publicKey field Mastodon expects and should unblock delivery.

Acceptance criteria coverage

Outbound ActivityPub HTTP signatures use https://.../users/{actor}#main-key.
Tests updated to prevent regression to #multikey-1 for delivery signatures.
Leaves actor document multikey/assertionMethod publication unchanged.

Verification

npm run typecheck
npm test -- --run src/federation/__tests__/delivery.test.ts src/federation/__tests__/routes.test.ts
npm test
npm run build

Follow-up gate

After merge/release/deploy, update the actor avatar again and verify logs no longer show Mastodon 401 Unauthorized for #multikey-1; expected signature key is #main-key and Mastodon should accept/apply the actor Update.

Blocking issues

None.

Verdict

Approved.

## Review summary Approved. Production logs show Mastodon rejects actor Update delivery signed with `#multikey-1` (`401 Unauthorized`, `Public key not found`). Switching HTTP signatures back to the actor `#main-key` matches the publicKey field Mastodon expects and should unblock delivery. ## Acceptance criteria coverage - [x] Outbound ActivityPub HTTP signatures use `https://.../users/{actor}#main-key`. - [x] Tests updated to prevent regression to `#multikey-1` for delivery signatures. - [x] Leaves actor document multikey/assertionMethod publication unchanged. ## Verification - `npm run typecheck` - `npm test -- --run src/federation/__tests__/delivery.test.ts src/federation/__tests__/routes.test.ts` - `npm test` - `npm run build` ## Follow-up gate After merge/release/deploy, update the actor avatar again and verify logs no longer show Mastodon `401 Unauthorized` for `#multikey-1`; expected signature key is `#main-key` and Mastodon should accept/apply the actor Update. ## Blocking issues None. ## Verdict Approved.

erik merged commit 03f478808a into main

2026-06-28 11:35:07 -05:00

erik deleted branch task-d213c262-use-main-key-signature

2026-06-28 11:35:07 -05:00

erik referenced this pull request from a commit

2026-06-28 11:35:08 -05:00

Use ActivityPub main key for HTTP signatures (#40)

erik referenced this pull request from a commit

2026-06-28 11:47:58 -05:00

Revert "Use ActivityPub main key for HTTP signatures (#40)"

erik referenced this pull request

2026-06-28 11:47:58 -05:00