Revert main-key ActivityPub signature regression #41

Merged

erik merged 1 commit from task-d213c262-revert-main-key-regression into main

2026-06-28 11:52:23 -05:00

erik commented

2026-06-28 11:47:58 -05:00

Owner

Summary

revert PR #40 and restore outbound ActivityPub signing with #multikey-1
closed task task-becaf72b already established that Mastodon stores the Fedify 2 RSA key as #multikey-1 and rejects #main-key delivery
keep actor update delivery/logging from PR #39 intact

Verification

npm run typecheck
npm test -- --run src/federation/tests/delivery.test.ts src/federation/tests/routes.test.ts
npm test
npm run build

Task: task-d213c262

Follow-up: investigate actor Update-specific rejection with #multikey-1 without regressing the known working post/follow delivery key.

## Summary - revert PR #40 and restore outbound ActivityPub signing with `#multikey-1` - closed task `task-becaf72b` already established that Mastodon stores the Fedify 2 RSA key as `#multikey-1` and rejects `#main-key` delivery - keep actor update delivery/logging from PR #39 intact ## Verification - npm run typecheck - npm test -- --run src/federation/__tests__/delivery.test.ts src/federation/__tests__/routes.test.ts - npm test - npm run build Task: task-d213c262 Follow-up: investigate actor Update-specific rejection with `#multikey-1` without regressing the known working post/follow delivery key.

erik added 1 commit

2026-06-28 11:47:58 -05:00

Revert "Use ActivityPub main key for HTTP signatures (#40 )" cf14490073

This reverts commit 03f478808a.

erik commented

2026-06-28 11:48:19 -05:00

Author

Owner

Review summary

Approved. This reverts PR #40, which contradicted the previously verified Mastodon fix in task-becaf72b. That task established that Mastodon stores the Fedify 2 actor key as #multikey-1 and rejects outbound delivery signed with #main-key.

Acceptance criteria coverage

Restores outbound ActivityPub delivery signing with #multikey-1.
Restores tests asserting #multikey-1 and rejecting #main-key for delivery signatures.
Leaves actor update delivery/logging from PR #39 intact.

Verification

npm run typecheck
npm test -- --run src/federation/__tests__/delivery.test.ts src/federation/__tests__/routes.test.ts
npm test
npm run build

Follow-up

The actor Update-specific Mastodon rejection still needs investigation, but we should not regress the known-working follow/post fanout key behavior while doing that.

Blocking issues

None.

Verdict

Approved.

## Review summary Approved. This reverts PR #40, which contradicted the previously verified Mastodon fix in `task-becaf72b`. That task established that Mastodon stores the Fedify 2 actor key as `#multikey-1` and rejects outbound delivery signed with `#main-key`. ## Acceptance criteria coverage - [x] Restores outbound ActivityPub delivery signing with `#multikey-1`. - [x] Restores tests asserting `#multikey-1` and rejecting `#main-key` for delivery signatures. - [x] Leaves actor update delivery/logging from PR #39 intact. ## Verification - `npm run typecheck` - `npm test -- --run src/federation/__tests__/delivery.test.ts src/federation/__tests__/routes.test.ts` - `npm test` - `npm run build` ## Follow-up The actor Update-specific Mastodon rejection still needs investigation, but we should not regress the known-working follow/post fanout key behavior while doing that. ## Blocking issues None. ## Verdict Approved.

erik merged commit cb113400c8 into main

2026-06-28 11:52:23 -05:00

erik deleted branch task-d213c262-revert-main-key-regression

2026-06-28 11:52:23 -05:00

erik referenced this pull request from a commit

2026-06-28 11:52:25 -05:00

Revert main-key ActivityPub signature regression (#41)

erik referenced this pull request

2026-06-28 11:52:48 -05:00

Bug: actor avatar changes do not notify ActivityPub followers #38

erik referenced this pull request

2026-06-28 11:58:22 -05:00