Move ActivityPub signing key outside actor path #45

Merged

erik merged 1 commit from task-d213c262-external-key-url into main

2026-06-28 13:20:04 -05:00

erik commented

2026-06-28 13:19:56 -05:00

Owner

Summary

move the ActivityPub HTTP signature key URL to /activitypub/keys/{actor}/main-key
advertise/sign with that external key URL
serve the external key route as an ActivityPub CryptographicKey

Why

Mastodon still treated /users/{actor}/main-key as not found, likely because URLs under /users/{actor} hit the cached actor lookup path and skip fetching. Keeping the key outside the actor namespace should force a direct key fetch and avoid the stale actor shortcut.

Verification

npm run typecheck
npm test -- --run src/federation/tests/routes.test.ts src/routes/tests/admin-activitypub.test.ts src/federation/tests/delivery.test.ts src/federation/tests/activitypub.test.ts
npm test
npm run build
docker build -t slugkit-com:local .

Task: task-d213c262

## Summary - move the ActivityPub HTTP signature key URL to `/activitypub/keys/{actor}/main-key` - advertise/sign with that external key URL - serve the external key route as an ActivityPub `CryptographicKey` ## Why Mastodon still treated `/users/{actor}/main-key` as not found, likely because URLs under `/users/{actor}` hit the cached actor lookup path and skip fetching. Keeping the key outside the actor namespace should force a direct key fetch and avoid the stale actor shortcut. ## Verification - npm run typecheck - npm test -- --run src/federation/__tests__/routes.test.ts src/routes/__tests__/admin-activitypub.test.ts src/federation/__tests__/delivery.test.ts src/federation/__tests__/activitypub.test.ts - npm test - npm run build - docker build -t slugkit-com:local . Task: task-d213c262

erik added 1 commit

2026-06-28 13:19:56 -05:00

Move ActivityPub signing key outside actor path 0b0dac266a

erik merged commit 6eaec541e9 into main

2026-06-28 13:20:04 -05:00

erik deleted branch task-d213c262-external-key-url

2026-06-28 13:20:04 -05:00

erik referenced this pull request from a commit

2026-06-28 13:20:05 -05:00

Move ActivityPub signing key outside actor path (#45)

erik referenced this pull request

2026-06-28 13:56:14 -05:00