Advertise ActivityPub signing key as legacy publicKey #43

Merged

erik merged 1 commit from task-d213c262-publickey-multikey-id into main

2026-06-28 12:54:28 -05:00

erik commented

2026-06-28 12:54:08 -05:00

Owner

Summary

expose the HTTP-signature key ID #multikey-1 through the legacy ActivityPub publicKey field
keep assertionMethod/Multikey publication intact
update settings/config/tests so the advertised public key URL matches the key used for outbound HTTP signatures

Why

Mastodon 4.7 rejects outbound delivery with Public key not found for key https://slugkit.com/users/slug#multikey-1 even though the key is present in assertionMethod. Publishing the same key through legacy publicKey.id gives Mastodon's HTTP signature key lookup a direct match for the key ID used on outbound requests.

Verification

npm run typecheck
npm test -- --run src/federation/tests/routes.test.ts src/routes/tests/admin-activitypub.test.ts src/federation/tests/delivery.test.ts src/federation/tests/activitypub.test.ts
npm test
npm run build

Task: task-d213c262

After release/deploy, force Mastodon to refollow/refetch and publish another test note.

## Summary - expose the HTTP-signature key ID `#multikey-1` through the legacy ActivityPub `publicKey` field - keep `assertionMethod`/Multikey publication intact - update settings/config/tests so the advertised public key URL matches the key used for outbound HTTP signatures ## Why Mastodon 4.7 rejects outbound delivery with `Public key not found for key https://slugkit.com/users/slug#multikey-1` even though the key is present in `assertionMethod`. Publishing the same key through legacy `publicKey.id` gives Mastodon's HTTP signature key lookup a direct match for the key ID used on outbound requests. ## Verification - npm run typecheck - npm test -- --run src/federation/__tests__/routes.test.ts src/routes/__tests__/admin-activitypub.test.ts src/federation/__tests__/delivery.test.ts src/federation/__tests__/activitypub.test.ts - npm test - npm run build Task: task-d213c262 After release/deploy, force Mastodon to refollow/refetch and publish another test note.

erik added 1 commit

2026-06-28 12:54:08 -05:00

Advertise ActivityPub signing key as legacy publicKey f405025c5c

erik merged commit f171b0146a into main

2026-06-28 12:54:28 -05:00

erik deleted branch task-d213c262-publickey-multikey-id

2026-06-28 12:54:28 -05:00

erik referenced this pull request from a commit

2026-06-28 12:54:29 -05:00

Advertise ActivityPub signing key as legacy publicKey (#43)

erik referenced this pull request

2026-06-28 13:56:14 -05:00