[feat] Support JSON-LD signatures - Implied Akkoma is misbehaving #471
Labels
No labels
approved, awaiting change
bug
configuration
documentation
duplicate
enhancement
extremely low priority
feature request
Fix it yourself
help wanted
invalid
mastodon_api
needs docs
needs tests
not a bug
planned
pleroma_api
privacy
question
static_fe
triage
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: AkkomaGang/akkoma#471
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The idea
I was looking to set up a possible relay and found the following recent change in the documentation for Asonix relay software:
9b809913ad
I don't know quite what that means, but I suspect it isn't the HTTP signature, but a separate JSON-LD signature.
This request would be to add validation of JSON-LD signatures.
The reasoning
I'm not quite sure of the scope of the comment in the Asonix relay documentation, but it seems to imply that Akkoma instances are "misbehaving?" when it comes to many core Activities?
Since I don't really understand all the technical details, I don't know how "serious" the situation is, but it certainly seems to imply that Akkoma instances won't honor Delete, Update, Add, and Remove activities from subscribed instances.
Have you searched for this feature request?
[feat] Support JSON-LD signaturesto [feat] Support JSON-LD signatures - Implied Akkoma is misbehavingAdding context: from what I understand, ActivityPub as a specification does not actually say how to sign posts, so there's two approaches adopted by implementations: JSON-LD and HTTP Signatures. The thing with JSON-LD signatures is that they are embedded in post bodies and so, can be relayed towards other citizens of the web that also support JSON-LD relatively easily, HTTP signatures only apply to a single request/response, and so, are detached from the request/response body, so the approach to relay them is different.
Mastodon already generates HTTP Signatures, it's why none of this has caught fire over the years, the issue is more about relays that emit JSON-LD specifically rather than Akkoma won't support posts from other instances, as most implementations generate HTTP sigs.
I don't know the context of why Pleroma has not added support JSON-LD, maybe code complexity? Any Pleroma archeologists around here to help on that one?
Thank you for the added context. I wonder now if there is wide support for JSON-LD signatures. The rest of that change commit seems to say that it's pretty common. Either way I also wonder why it wasn't added. I wonder also since Mastodon apparently only processes JSON-LD as simple JSON instead of JSON-LD.
https://docs.joinmastodon.org/spec/security/
Looks like Mastodon does use them some, but specifically recommends against implementing them due to being superceeded.
JSON-LD is not supported because it is notably different to the raw data and the pattern matching would completely break
Would this apply to just signature verification as well? I don't know enough and just trying to understand.
well yes, we can't pattern match the signature if we don't ld-decode the entire document
I thought Mastodon doesn't actually process as JSON-LD either and just parses as simple JSON.
https://mastodon.online/@Gargron@mastodon.social/109837277162493708
And the Mastodon documents list how they take the JSON key pairs and validate the signature.
it appears that ld signatures are long deprecated and some new standard is proposed