Sign ActivityPub delivery with acct key id #46

Merged

erik merged 1 commit from task-d213c262-acct-signature-key into main

2026-06-28 13:30:48 -05:00

erik commented

2026-06-28 13:30:48 -05:00

Owner

Summary

sign outbound ActivityPub delivery using acct:{actor}@{domain} as the HTTP signature key ID
keep the actor document and external key endpoint in place

Why

Mastodon has a cached remote account for @slug@slugkit.com but repeatedly fails URI-based key lookup. Its acct: key path resolves the account and verifies with the account's cached keypair, avoiding the poisoned key-URI lookup.

Verification

npm run typecheck
npm test -- --run src/federation/tests/routes.test.ts src/federation/tests/delivery.test.ts src/routes/tests/admin-activitypub.test.ts src/federation/tests/activitypub.test.ts
npm test
npm run build

Task: task-d213c262

## Summary - sign outbound ActivityPub delivery using `acct:{actor}@{domain}` as the HTTP signature key ID - keep the actor document and external key endpoint in place ## Why Mastodon has a cached remote account for `@slug@slugkit.com` but repeatedly fails URI-based key lookup. Its `acct:` key path resolves the account and verifies with the account's cached keypair, avoiding the poisoned key-URI lookup. ## Verification - npm run typecheck - npm test -- --run src/federation/__tests__/routes.test.ts src/federation/__tests__/delivery.test.ts src/routes/__tests__/admin-activitypub.test.ts src/federation/__tests__/activitypub.test.ts - npm test - npm run build Task: task-d213c262

erik added 1 commit

2026-06-28 13:30:48 -05:00

Sign ActivityPub delivery with acct key id 933da35a6a

erik merged commit 0dd3446fc1 into main

2026-06-28 13:30:48 -05:00

erik deleted branch task-d213c262-acct-signature-key

2026-06-28 13:30:49 -05:00

erik referenced this pull request from a commit

2026-06-28 13:30:50 -05:00

Sign ActivityPub delivery with acct key id (#46)

erik referenced this pull request

2026-06-28 13:56:14 -05:00