Use standalone ActivityPub signature key URL #44

Merged

erik merged 1 commit from task-d213c262-standalone-main-key into main

2026-06-28 13:12:07 -05:00

erik commented

2026-06-28 13:11:57 -05:00

Owner

Summary

use https://slugkit.com/users/{actor}/main-key as the outbound HTTP signature key ID
advertise that same standalone key URL in the actor legacy publicKey field
serve /users/{actor}/main-key as an ActivityPub CryptographicKey object
keep Fedify assertionMethod/#multikey-1 publication intact

Why

Mastodon 4.7 can keep a cached actor record that prevents refetching an updated actor document for #multikey-1. A standalone key URL avoids the actor-fragment lookup path and gives Mastodon a concrete key resource to fetch and confirm against actor.publicKey.

Verification

npm run typecheck
npm test -- --run src/federation/tests/routes.test.ts src/routes/tests/admin-activitypub.test.ts src/federation/tests/delivery.test.ts src/federation/tests/activitypub.test.ts
npm test
npm run build
docker build -t slugkit-com:local .

Task: task-d213c262

## Summary - use `https://slugkit.com/users/{actor}/main-key` as the outbound HTTP signature key ID - advertise that same standalone key URL in the actor legacy `publicKey` field - serve `/users/{actor}/main-key` as an ActivityPub `CryptographicKey` object - keep Fedify `assertionMethod`/`#multikey-1` publication intact ## Why Mastodon 4.7 can keep a cached actor record that prevents refetching an updated actor document for `#multikey-1`. A standalone key URL avoids the actor-fragment lookup path and gives Mastodon a concrete key resource to fetch and confirm against `actor.publicKey`. ## Verification - npm run typecheck - npm test -- --run src/federation/__tests__/routes.test.ts src/routes/__tests__/admin-activitypub.test.ts src/federation/__tests__/delivery.test.ts src/federation/__tests__/activitypub.test.ts - npm test - npm run build - docker build -t slugkit-com:local . Task: task-d213c262

erik added 1 commit

2026-06-28 13:11:57 -05:00

Use standalone ActivityPub signature key URL 9bba38a320

erik merged commit 7951b7a482 into main

2026-06-28 13:12:07 -05:00

erik deleted branch task-d213c262-standalone-main-key

2026-06-28 13:12:07 -05:00

erik referenced this pull request from a commit

2026-06-28 13:12:08 -05:00

Use standalone ActivityPub signature key URL (#44)

erik referenced this pull request

2026-06-28 13:56:14 -05:00