erik/slugkit

Fork 0

Fix Mastodon ActivityPub key refresh in template site #227

New issue

Closed

opened 2026-06-28 14:01:49 -05:00 by erik · 5 comments

erik commented

2026-06-28 14:01:49 -05:00

Owner

Summary

Generated Slugkit template sites can hit the same Mastodon 4.7 ActivityPub delivery failure fixed in slugkit.com: outbound delivery is rejected because Mastodon cannot resolve the signing key from the actor/key shape.

Reference implementation from slugkit.com:

Final deployed fix: web-v0.1.32
Final actor key shape: legacy publicKey only, with publicKey.id = /activitypub/keys/{actor}/main-key
assertionMethod omitted for Mastodon compatibility
outbound delivery signed with acct:{actor}@{domain}

Steps to reproduce

Generate or run a Slugkit template site with ActivityPub enabled.
Follow the site actor from Mastodon 4.7.
Publish a post or save actor profile/avatar settings.
Inspect Mastodon relationship/status delivery and server delivery logs.

Expected behavior

Mastodon accepts Follow Accept, Create, and actor Update delivery.
The remote follow relationship leaves pending state.
Published posts appear on the Mastodon account timeline.
Actor profile/avatar Updates are accepted by Mastodon.

Actual behavior

Template site federation may still use an incompatible actor key/signature shape.
Mastodon can reject delivery with key lookup errors such as Public key not found for key ... or Could not refresh public key ....

Acceptance criteria

Template-generated sites publish the Mastodon-compatible legacy publicKey shape used by slugkit.com.
Template-generated sites serve the standalone key at /activitypub/keys/{actor}/main-key.
Template-generated sites omit assertionMethod unless/until Mastodon compatibility is safely restored.
Outbound ActivityPub delivery signs with acct:{actor}@{domain} or an equivalently verified Mastodon-compatible key ID.
Tests cover actor document serialization, standalone key route, and outbound signature key ID.
Verify against Mastodon after deploy using a follow/refollow, a published test note, and an actor profile/avatar Update.

## Summary Generated Slugkit template sites can hit the same Mastodon 4.7 ActivityPub delivery failure fixed in `slugkit.com`: outbound delivery is rejected because Mastodon cannot resolve the signing key from the actor/key shape. Reference implementation from `slugkit.com`: - Final deployed fix: `web-v0.1.32` - Final actor key shape: legacy `publicKey` only, with `publicKey.id = /activitypub/keys/{actor}/main-key` - `assertionMethod` omitted for Mastodon compatibility - outbound delivery signed with `acct:{actor}@{domain}` ## Steps to reproduce 1. Generate or run a Slugkit template site with ActivityPub enabled. 2. Follow the site actor from Mastodon 4.7. 3. Publish a post or save actor profile/avatar settings. 4. Inspect Mastodon relationship/status delivery and server delivery logs. ## Expected behavior - Mastodon accepts Follow Accept, Create, and actor Update delivery. - The remote follow relationship leaves pending state. - Published posts appear on the Mastodon account timeline. - Actor profile/avatar Updates are accepted by Mastodon. ## Actual behavior - Template site federation may still use an incompatible actor key/signature shape. - Mastodon can reject delivery with key lookup errors such as `Public key not found for key ...` or `Could not refresh public key ...`. ## Acceptance criteria - [ ] Template-generated sites publish the Mastodon-compatible legacy `publicKey` shape used by `slugkit.com`. - [ ] Template-generated sites serve the standalone key at `/activitypub/keys/{actor}/main-key`. - [ ] Template-generated sites omit `assertionMethod` unless/until Mastodon compatibility is safely restored. - [ ] Outbound ActivityPub delivery signs with `acct:{actor}@{domain}` or an equivalently verified Mastodon-compatible key ID. - [ ] Tests cover actor document serialization, standalone key route, and outbound signature key ID. - [ ] Verify against Mastodon after deploy using a follow/refollow, a published test note, and an actor profile/avatar Update.

erik added the

labels

2026-06-28 14:01:49 -05:00

erik added

status:inprogress

and removed

status:active

labels

2026-06-30 08:11:28 -05:00

erik commented

2026-06-30 08:22:44 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T13:21:12.402Z

Review update

PR: #249 is open with Forgejo CI run #368 passing.
Result: approved for merge.
Verified in code/tests: Mastodon-compatible legacy publicKey, standalone /activitypub/keys/{actor}/main-key route, omitted assertionMethod, outbound acct:{actor}@{domain} signing, focused federation/admin ActivityPub tests, template/CLI package dry-runs, ./scripts/pre-pr.sh, and Forgejo CI build-lint-test passed.
Pending before task closure: live Mastodon verification after deploy: follow/refollow, publish test note, save actor profile/avatar Update, and inspect logs for absence of key refresh errors.

_Synced from todu comment by @todu on 2026-06-30T13:21:12.402Z_ ### Review update - PR: #249 is open with Forgejo CI run #368 passing. - Result: approved for merge. - Verified in code/tests: Mastodon-compatible legacy `publicKey`, standalone `/activitypub/keys/{actor}/main-key` route, omitted `assertionMethod`, outbound `acct:{actor}@{domain}` signing, focused federation/admin ActivityPub tests, template/CLI package dry-runs, `./scripts/pre-pr.sh`, and Forgejo CI `build-lint-test` passed. - Pending before task closure: live Mastodon verification after deploy: follow/refollow, publish test note, save actor profile/avatar Update, and inspect logs for absence of key refresh errors.

erik commented

2026-06-30 09:18:58 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T14:18:35.650Z

Merge and release update

PR #249 merged into main.
Forgejo push CI passed: run #369.
Published release artifacts:
- @evcraddock/slug-template@0.1.2 via run #370.
- @evcraddock/slug-cli@0.6.2 via run #371.
Verified npm registry availability for both published versions.
Verified post-publish generated template behavior with @evcraddock/slug-cli@0.6.2 installed from npm:
- npx slug init generated template metadata version 0.1.2.
- Generated site does not keep @evcraddock/slug-template as a runtime dependency.
- Generated federation code includes /activitypub/keys/:identifier/main-key.
- Generated federation code omits assertionMethods.
- Generated federation key sender code uses acct:{actor}@{domain} key IDs.

Remaining before task closure: live Mastodon verification on a deployed ActivityPub-enabled site: follow/refollow, publish test note, save actor profile/avatar Update, and confirm Mastodon delivery logs no longer show key refresh errors.

_Synced from todu comment by @todu on 2026-06-30T14:18:35.650Z_ ### Merge and release update - PR #249 merged into `main`. - Forgejo push CI passed: run #369. - Published release artifacts: - `@evcraddock/slug-template@0.1.2` via run #370. - `@evcraddock/slug-cli@0.6.2` via run #371. - Verified npm registry availability for both published versions. - Verified post-publish generated template behavior with `@evcraddock/slug-cli@0.6.2` installed from npm: - `npx slug init` generated template metadata version `0.1.2`. - Generated site does not keep `@evcraddock/slug-template` as a runtime dependency. - Generated federation code includes `/activitypub/keys/:identifier/main-key`. - Generated federation code omits `assertionMethods`. - Generated federation key sender code uses `acct:{actor}@{domain}` key IDs. Remaining before task closure: live Mastodon verification on a deployed ActivityPub-enabled site: follow/refollow, publish test note, save actor profile/avatar Update, and confirm Mastodon delivery logs no longer show key refresh errors.

erik added

status:waiting

and removed

status:inprogress

labels

2026-06-30 10:04:05 -05:00

erik commented

2026-06-30 10:04:05 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T15:00:51.438Z

Set to waiting because all code, CI, merge, npm release, and generated-template verification are complete, but the final acceptance criterion requires live Mastodon verification on a deployed ActivityPub-enabled site: follow/refollow, publish a test note, save actor profile/avatar Update, and confirm no Mastodon key refresh errors in delivery logs.

_Synced from todu comment by @todu on 2026-06-30T15:00:51.438Z_ Set to waiting because all code, CI, merge, npm release, and generated-template verification are complete, but the final acceptance criterion requires live Mastodon verification on a deployed ActivityPub-enabled site: follow/refollow, publish a test note, save actor profile/avatar Update, and confirm no Mastodon key refresh errors in delivery logs.

erik added

status:inprogress

and removed

status:waiting

labels

2026-06-30 14:40:39 -05:00

erik commented

2026-06-30 14:46:15 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T19:43:14.351Z

Blocked on live Mastodon verification

Attempted to resume final verification. The configured local Slug API target in /home/erik/Private/code/forgejo/slugkit/.slug/dev.yaml points at http://10.10.1.197:3000/api/v1, but it was not running initially. I started the required local dev environment with make dev, and local health responded at http://localhost:3000/api/v1/health.

This does not satisfy the remaining acceptance criterion because Mastodon verification requires a public ActivityPub-enabled deployed generated-template site plus a Mastodon account/session and access to delivery logs. The local dev server uses a private LAN origin and cannot be followed/refollowed by Mastodon for this acceptance check.

Needed to complete:

Public HTTPS URL of the deployed generated-template site to verify.
Actor handle to follow/refollow from Mastodon.
Mastodon account/session or explicit manual verification result.
Access to deployment/delivery logs, or pasted log evidence, confirming no Mastodon key refresh errors after Follow Accept, Create, and actor Update delivery.

_Synced from todu comment by @todu on 2026-06-30T19:43:14.351Z_ ### Blocked on live Mastodon verification Attempted to resume final verification. The configured local Slug API target in `/home/erik/Private/code/forgejo/slugkit/.slug/dev.yaml` points at `http://10.10.1.197:3000/api/v1`, but it was not running initially. I started the required local dev environment with `make dev`, and local health responded at `http://localhost:3000/api/v1/health`. This does not satisfy the remaining acceptance criterion because Mastodon verification requires a public ActivityPub-enabled deployed generated-template site plus a Mastodon account/session and access to delivery logs. The local dev server uses a private LAN origin and cannot be followed/refollowed by Mastodon for this acceptance check. Needed to complete: - Public HTTPS URL of the deployed generated-template site to verify. - Actor handle to follow/refollow from Mastodon. - Mastodon account/session or explicit manual verification result. - Access to deployment/delivery logs, or pasted log evidence, confirming no Mastodon key refresh errors after Follow Accept, Create, and actor Update delivery.

erik

2026-06-30 14:57:40 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-30 14:57:40 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-30T19:52:55.815Z

Closed by explicit user request

The implementation, review, merge, release, generated-template verification, and production slugkit.com ActivityPub spot checks are complete enough for closure per explicit user direction.

Evidence already gathered:

PR #249 was merged.
Published artifacts were verified: @evcraddock/slug-template@0.1.2 and @evcraddock/slug-cli@0.6.2.
Generated template verification confirmed the standalone key route, omitted assertionMethod, and acct:{actor}@{domain} signing behavior.
https://slugkit.com/.well-known/webfinger?resource=acct:slug@slugkit.com resolves to https://slugkit.com/users/slug.
https://slugkit.com/users/slug exposes legacy publicKey only and omits assertionMethod.
https://slugkit.com/activitypub/keys/slug/main-key serves the standalone key.
Production logs show Mastodon follow handling succeeded for @evcraddock@mastodon.online and queued the Follow Accept.

Closing without further live publish/profile-update probing per user instruction.

_Synced from todu comment by @todu on 2026-06-30T19:52:55.815Z_ ### Closed by explicit user request The implementation, review, merge, release, generated-template verification, and production `slugkit.com` ActivityPub spot checks are complete enough for closure per explicit user direction. Evidence already gathered: - PR #249 was merged. - Published artifacts were verified: `@evcraddock/slug-template@0.1.2` and `@evcraddock/slug-cli@0.6.2`. - Generated template verification confirmed the standalone key route, omitted `assertionMethod`, and `acct:{actor}@{domain}` signing behavior. - `https://slugkit.com/.well-known/webfinger?resource=acct:slug@slugkit.com` resolves to `https://slugkit.com/users/slug`. - `https://slugkit.com/users/slug` exposes legacy `publicKey` only and omits `assertionMethod`. - `https://slugkit.com/activitypub/keys/slug/main-key` serves the standalone key. - Production logs show Mastodon follow handling succeeded for `@evcraddock@mastodon.online` and queued the Follow Accept. Closing without further live publish/profile-update probing per user instruction.