Tracking RFC 9421 Adoption

evan

One of the big pain points for ActivityPub developers is supporting HTTP Signature in their servers. The Fediverse uses an out-dated draft standard, draft cavage 12. There's a helpful ActivityPub and HTTP Signatures report from the SocialCG, but it's still kind of a slog.

Some server software has begun the pivot to using double-knocking, capability discovery, or something else.

To track support for RFC 9421, I added an adoption matrix to the ActivityPub HTTP Signature repo. I grabbed all the software listed on FediDB, and laid out a matrix of whether it accepts RFC 9421 signatures for GET and POST or sends RFC 9421 for GET and POST. I also included a way to find relevant bug-tracker issues.

https://swicg.github.io/activitypub-http-signature/RFC9421

It would be a huge help to get some more eyes and data on this adoption matrix. If you know about a Fediverse server package's support for RFC 9421, including your own, please make a PR against the RFC9421.md file in the swicg/activitypub-http-signature repo.

Thanks!

julian

I will say that adoption of RFC 9421 is a more difficult than anticipated because many of us hacked our cavage-12 implementations in by testing against Mastodon.

Specifically, I remember a very old (and outdated even then!) blog post by @gargron@mastodon.social about how Signatures were implemented by Mastodon, and that formed the basis of how NodeBB signed its messages.

I'm glad we're moving on but I think for the majority of us, having a reliable library to do the heavy lifting is important.

Don't roll your own HTTP signatures folks!

Michael 🇺🇦

@evan I will try to keep it on my mind, when we eventuall have got a release. We included it in our upcoming release.

BTW: I saw that tags.pub is working with it, so our implementation doesn't seem completely wrong here