Fix Mastodon ActivityPub key refresh in template site #249

Merged

erik merged 1 commit from fix/task-1fe99cef-mastodon-key-refresh into main

2026-06-30 09:12:40 -05:00

erik commented

2026-06-30 08:19:05 -05:00

Owner

Summary

Change template ActivityPub actor documents to advertise Mastodon-compatible legacy publicKey only.
Serve standalone public keys at /activitypub/keys/{actor}/main-key.
Omit assertionMethod from local actor documents for Mastodon compatibility.
Sign outbound ActivityPub delivery with acct:{actor}@{domain}.
Update admin URL display, federation docs, and tests for actor serialization, standalone key route, and outbound signature key IDs.
Bump @evcraddock/slug-template to 0.1.2 and @evcraddock/slug-cli to 0.6.2 so future generated sites get the fixed template package.

Verification

npm run typecheck --workspace @slugkit/template-site
npm test --workspace @slugkit/template-site -- src/federation src/routes/__tests__/admin-activitypub.test.ts
npm run build --workspace @evcraddock/slug-template
npm run build --workspace @evcraddock/slug-cli
npm test --workspace @evcraddock/slug-template
npm test --workspace @evcraddock/slug-cli -- commands.test.ts
npm run package:pack:dry-run -- --workspace @evcraddock/slug-template
npm run package:release -- --workspace @evcraddock/slug-template --dry-run
npm pack --workspace @evcraddock/slug-cli --dry-run
./scripts/pre-pr.sh

Manual verification still required

Live Mastodon verification requires a deployed ActivityPub-enabled site. After merge/release, verify with:

Follow/refollow the site actor from Mastodon 4.7.
Publish a test note and confirm it appears on the Mastodon timeline.
Save actor profile/avatar settings and confirm Mastodon accepts the Update.
Inspect delivery logs for absence of Public key not found / Could not refresh public key errors.

Task: #task-1fe99cef

## Summary - Change template ActivityPub actor documents to advertise Mastodon-compatible legacy `publicKey` only. - Serve standalone public keys at `/activitypub/keys/{actor}/main-key`. - Omit `assertionMethod` from local actor documents for Mastodon compatibility. - Sign outbound ActivityPub delivery with `acct:{actor}@{domain}`. - Update admin URL display, federation docs, and tests for actor serialization, standalone key route, and outbound signature key IDs. - Bump `@evcraddock/slug-template` to `0.1.2` and `@evcraddock/slug-cli` to `0.6.2` so future generated sites get the fixed template package. ## Verification - `npm run typecheck --workspace @slugkit/template-site` - `npm test --workspace @slugkit/template-site -- src/federation src/routes/__tests__/admin-activitypub.test.ts` - `npm run build --workspace @evcraddock/slug-template` - `npm run build --workspace @evcraddock/slug-cli` - `npm test --workspace @evcraddock/slug-template` - `npm test --workspace @evcraddock/slug-cli -- commands.test.ts` - `npm run package:pack:dry-run -- --workspace @evcraddock/slug-template` - `npm run package:release -- --workspace @evcraddock/slug-template --dry-run` - `npm pack --workspace @evcraddock/slug-cli --dry-run` - `./scripts/pre-pr.sh` ## Manual verification still required Live Mastodon verification requires a deployed ActivityPub-enabled site. After merge/release, verify with: 1. Follow/refollow the site actor from Mastodon 4.7. 2. Publish a test note and confirm it appears on the Mastodon timeline. 3. Save actor profile/avatar settings and confirm Mastodon accepts the Update. 4. Inspect delivery logs for absence of `Public key not found` / `Could not refresh public key` errors. Task: #task-1fe99cef

erik added 1 commit

2026-06-30 08:19:05 -05:00

fix: use mastodon-compatible activitypub keys

CI / build-lint-test (pull_request) Successful in 1m0s

Details

d47dc82b83

Task: #task-1fe99cef

erik commented

2026-06-30 08:21:00 -05:00

Author

Owner

Review summary

PR #249 updates the template site's ActivityPub key/signature behavior to match the Mastodon-compatible shape from the task: legacy publicKey, standalone key route, no assertionMethod, and outbound acct:{actor}@{domain} signing. It also bumps @evcraddock/slug-template and @evcraddock/slug-cli so future generated sites can receive the fixed template package after release.

Acceptance criteria

Template-generated sites publish the Mastodon-compatible legacy publicKey shape used by slugkit.com — actor document now advertises publicKey with /activitypub/keys/{actor}/main-key.
Template-generated sites serve the standalone key at /activitypub/keys/{actor}/main-key — route and test added.
Template-generated sites omit assertionMethod unless/until Mastodon compatibility is safely restored — actor tests assert omission.
Outbound ActivityPub delivery signs with acct:{actor}@{domain} or compatible key ID — delivery and follow-accept tests assert acct:erik@example.com and no multikey/main-key fragment signature IDs.
Tests cover actor document serialization, standalone key route, and outbound signature key ID — federation route/delivery tests updated.
Verify against Mastodon after deploy using follow/refollow, published test note, and actor profile/avatar Update — requires deployed ActivityPub site and real Mastodon 4.7 interaction; PR body documents exact steps.

Verification

./scripts/pre-pr.sh passed locally.
Forgejo CI run #368 passed.
Focused federation/admin ActivityPub tests passed.
@evcraddock/slug-template pack/release dry-runs passed.
@evcraddock/slug-cli pack dry-run passed.

Blocking issues

None for merging code. Live Mastodon verification remains a deploy-time acceptance check before task closure.

Verdict

Approved for merge; do not close task until post-deploy Mastodon verification is complete or explicitly waived.

### Review summary PR #249 updates the template site's ActivityPub key/signature behavior to match the Mastodon-compatible shape from the task: legacy `publicKey`, standalone key route, no `assertionMethod`, and outbound `acct:{actor}@{domain}` signing. It also bumps `@evcraddock/slug-template` and `@evcraddock/slug-cli` so future generated sites can receive the fixed template package after release. ### Acceptance criteria - [x] Template-generated sites publish the Mastodon-compatible legacy `publicKey` shape used by `slugkit.com` — actor document now advertises `publicKey` with `/activitypub/keys/{actor}/main-key`. - [x] Template-generated sites serve the standalone key at `/activitypub/keys/{actor}/main-key` — route and test added. - [x] Template-generated sites omit `assertionMethod` unless/until Mastodon compatibility is safely restored — actor tests assert omission. - [x] Outbound ActivityPub delivery signs with `acct:{actor}@{domain}` or compatible key ID — delivery and follow-accept tests assert `acct:erik@example.com` and no multikey/main-key fragment signature IDs. - [x] Tests cover actor document serialization, standalone key route, and outbound signature key ID — federation route/delivery tests updated. - [ ] Verify against Mastodon after deploy using follow/refollow, published test note, and actor profile/avatar Update — requires deployed ActivityPub site and real Mastodon 4.7 interaction; PR body documents exact steps. ### Verification - `./scripts/pre-pr.sh` passed locally. - Forgejo CI run #368 passed. - Focused federation/admin ActivityPub tests passed. - `@evcraddock/slug-template` pack/release dry-runs passed. - `@evcraddock/slug-cli` pack dry-run passed. ### Blocking issues None for merging code. Live Mastodon verification remains a deploy-time acceptance check before task closure. ### Verdict Approved for merge; do not close task until post-deploy Mastodon verification is complete or explicitly waived.

erik referenced this pull request

2026-06-30 08:22:44 -05:00

Fix Mastodon ActivityPub key refresh in template site #227

erik merged commit 4cb9dd57b7 into main

2026-06-30 09:12:40 -05:00

erik deleted branch fix/task-1fe99cef-mastodon-key-refresh

2026-06-30 09:12:40 -05:00

erik referenced this pull request from a commit

2026-06-30 09:12:41 -05:00

Merge pull request 'Fix Mastodon ActivityPub key refresh in template site' (#249) from fix/task-1fe99cef-mastodon-key-refresh into main

erik referenced this pull request

2026-06-30 09:18:58 -05:00