Port ActivityPub multikey delivery fix #210

New issue

Closed

opened 2026-06-27 09:59:30 -05:00 by erik · 2 comments

erik commented

2026-06-27 09:59:30 -05:00

Owner

Summary

Generated Slugkit template sites need the ActivityPub delivery key-id fix proven in the slugkit.com generated site. Mastodon 4.7 can store Fedify 2 actor keys from assertionMethod as #multikey-1, while Fedify's default { identifier } send path signs outbound requests as #main-key. This caused Mastodon to reject delivered Accept and Create activities with Public key not found for key ...#main-key.

Reference implementation

Use the working generated-site code in /Users/erik/Private/code/forgejo/slugkit.com as the primary reference.

Relevant commits:

9f5e309 (Sign ActivityPub sends with multikey id)
4c302d6 (Sign follower fanout with multikey id)

Relevant files in that repo:

src/federation/keys.ts
src/federation/follow.ts
src/federation/delivery.ts
src/federation/routes.ts
src/federation/__tests__/routes.test.ts
src/federation/__tests__/delivery.test.ts

Requirements

Port the direct outbound ActivityPub signing fix into the Slugkit template site without downgrading Fedify.
Ensure valid incoming Follow activities are accepted with an outbound Accept signed using the Fedify 2 multikey id (#multikey-1) rather than the default legacy #main-key sender path.
Ensure follower fanout delivery for published posts also signs with #multikey-1.
Avoid changing the actor document's legacy publicKey.id unless a separate key-alignment task explicitly requires it.
Keep the current Fedify version strategy; do not downgrade Fedify to match older working sites.
Preserve support for shared inbox delivery where configured.
Add or update regression tests showing outbound Follow Accept and follower fanout use #multikey-1 and do not use #main-key for HTTP signature sender key ids.
Check for any remaining outbound context.sendActivity({ identifier: ... }) paths in the template site's ActivityPub code and either convert them or document why they are safe.

Acceptance criteria

Template-generated sites sign outbound Follow Accept delivery with https://<site>/users/<actor>#multikey-1.
Template-generated sites sign follower fanout post delivery with https://<site>/users/<actor>#multikey-1.
Existing legacy actor publicKey output remains compatible unless intentionally changed.
Regression tests cover both direct Accept delivery and follower fanout delivery key ids.
Tests and build for the Slugkit template site pass.
Implementation notes reference the slugkit.com proof-of-fix commits above.

Dependencies

None

## Summary Generated Slugkit template sites need the ActivityPub delivery key-id fix proven in the `slugkit.com` generated site. Mastodon 4.7 can store Fedify 2 actor keys from `assertionMethod` as `#multikey-1`, while Fedify's default `{ identifier }` send path signs outbound requests as `#main-key`. This caused Mastodon to reject delivered `Accept` and `Create` activities with `Public key not found for key ...#main-key`. ## Reference implementation Use the working generated-site code in `/Users/erik/Private/code/forgejo/slugkit.com` as the primary reference. Relevant commits: - `9f5e309` (`Sign ActivityPub sends with multikey id`) - `4c302d6` (`Sign follower fanout with multikey id`) Relevant files in that repo: - `src/federation/keys.ts` - `src/federation/follow.ts` - `src/federation/delivery.ts` - `src/federation/routes.ts` - `src/federation/__tests__/routes.test.ts` - `src/federation/__tests__/delivery.test.ts` ## Requirements - Port the direct outbound ActivityPub signing fix into the Slugkit template site without downgrading Fedify. - Ensure valid incoming `Follow` activities are accepted with an outbound `Accept` signed using the Fedify 2 multikey id (`#multikey-1`) rather than the default legacy `#main-key` sender path. - Ensure follower fanout delivery for published posts also signs with `#multikey-1`. - Avoid changing the actor document's legacy `publicKey.id` unless a separate key-alignment task explicitly requires it. - Keep the current Fedify version strategy; do not downgrade Fedify to match older working sites. - Preserve support for shared inbox delivery where configured. - Add or update regression tests showing outbound Follow `Accept` and follower fanout use `#multikey-1` and do not use `#main-key` for HTTP signature sender key ids. - Check for any remaining outbound `context.sendActivity({ identifier: ... })` paths in the template site's ActivityPub code and either convert them or document why they are safe. ## Acceptance criteria - [ ] Template-generated sites sign outbound Follow `Accept` delivery with `https://<site>/users/<actor>#multikey-1`. - [ ] Template-generated sites sign follower fanout post delivery with `https://<site>/users/<actor>#multikey-1`. - [ ] Existing legacy actor `publicKey` output remains compatible unless intentionally changed. - [ ] Regression tests cover both direct Accept delivery and follower fanout delivery key ids. - [ ] Tests and build for the Slugkit template site pass. - [ ] Implementation notes reference the slugkit.com proof-of-fix commits above. ## Dependencies - None

erik added the

labels

2026-06-27 09:59:30 -05:00

erik commented

2026-06-27 10:38:15 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-27T15:35:35.588Z

Review update

PR: #211 is open with Forgejo CI passing.
Result: approved.
Follow-up: waiting for explicit human merge approval.

Acceptance criteria: 6/6 met. Blocking issues: 0. Warnings: 0.

_Synced from todu comment by @todu on 2026-06-27T15:35:35.588Z_ ### Review update - PR: https://forge.caradoc.com/erik/slugkit/pulls/211 is open with Forgejo CI passing. - Result: approved. - Follow-up: waiting for explicit human merge approval. Acceptance criteria: 6/6 met. Blocking issues: 0. Warnings: 0.

erik

2026-06-27 10:43:46 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-27 10:43:46 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-27T15:40:34.401Z

Close gate result

Readiness: READY

Evidence:

PR #211 (fix: sign ActivityPub delivery with multikey id) has been merged into main and local main is fast-forwarded at merge commit e3013ff.
Review artifact reported Forgejo CI passing, approval, and 6/6 acceptance criteria met.
Merged template code uses #multikey-1 signing in template/site/src/federation/keys.ts, outbound delivery paths in delivery.ts/follow.ts/routes.ts, and regression assertions in routes.test.ts and delivery.test.ts verify #multikey-1 and not #main-key.
Legacy actor publicKey compatibility is preserved in template/site/src/federation/config.ts and actor route tests still assert #main-key publicKey output.

_Synced from todu comment by @todu on 2026-06-27T15:40:34.401Z_ ### Close gate result Readiness: READY Evidence: - PR #211 (`fix: sign ActivityPub delivery with multikey id`) has been merged into `main` and local `main` is fast-forwarded at merge commit `e3013ff`. - Review artifact reported Forgejo CI passing, approval, and 6/6 acceptance criteria met. - Merged template code uses `#multikey-1` signing in `template/site/src/federation/keys.ts`, outbound delivery paths in `delivery.ts`/`follow.ts`/`routes.ts`, and regression assertions in `routes.test.ts` and `delivery.test.ts` verify `#multikey-1` and not `#main-key`. - Legacy actor `publicKey` compatibility is preserved in `template/site/src/federation/config.ts` and actor route tests still assert `#main-key` publicKey output.