<![CDATA[Tracking RFC 9421 Adoption]]>One of the big pain points for ActivityPub developers is supporting HTTP Signature in their servers. The Fediverse uses an out-dated draft standard, draft cavage 12. There's a helpful ActivityPub and HTTP Signatures report from the SocialCG, but it's still kind of a slog.

Some server software has begun the pivot to using double-knocking, capability discovery, or something else.

To track support for RFC 9421, I added an adoption matrix to the ActivityPub HTTP Signature repo. I grabbed all the software listed on FediDB, and laid out a matrix of whether it accepts RFC 9421 signatures for GET and POST or sends RFC 9421 for GET and POST. I also included a way to find relevant bug-tracker issues.

https://swicg.github.io/activitypub-http-signature/RFC9421

It would be a huge help to get some more eyes and data on this adoption matrix. If you know about a Fediverse server package's support for RFC 9421, including your own, please make a PR against the RFC9421.md file in the swicg/activitypub-http-signature repo.

Thanks!

]]>https://postcall.pub/topic/3c6a7345-ad4f-483d-85a2-84a4515f2251/tracking-rfc-9421-adoptionRSS for NodeFri, 23 Oct 2026 02:21:20 GMTSun, 16 Aug 2026 18:11:05 GMT60<![CDATA[Reply to Tracking RFC 9421 Adoption on Mon, 28 Sep 2026 12:28:42 GMT]]>@evan I will try to keep it on my mind, when we eventuall have got a release. We included it in our upcoming release.

BTW: I saw that tags.pub is working with it, so our implementation doesn't seem completely wrong here 😀

]]>https://postcall.pub/post/https://pirati.ca/objects/ec054ce7-376a-ba5d-7a76-ea2517369122https://postcall.pub/post/https://pirati.ca/objects/ec054ce7-376a-ba5d-7a76-ea2517369122Mon, 28 Sep 2026 12:28:42 GMT<![CDATA[Reply to Tracking RFC 9421 Adoption on Mon, 17 Aug 2026 17:18:00 GMT]]>I will say that adoption of RFC 9421 is a more difficult than anticipated because many of us hacked our cavage-12 implementations in by testing against Mastodon.

Specifically, I remember a very old (and outdated even then!) blog post by @gargron@mastodon.social about how Signatures were implemented by Mastodon, and that formed the basis of how NodeBB signed its messages.

I'm glad we're moving on but I think for the majority of us, having a reliable library to do the heavy lifting is important.

Don't roll your own HTTP signatures folks!

]]>https://postcall.pub/post/https://activitypub.space/post/2367https://postcall.pub/post/https://activitypub.space/post/2367Mon, 17 Aug 2026 17:18:00 GMT