<![CDATA[Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures.]]>RE: https://mastodon.social/@bagder/116359048796181736

Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures.

On the flip side, ever more complex curl invocations (here: Accept header plus signature fields plus key file, presumably) suggest use of more specialized CLI tools, such as provided by @fedify, or at least scripts/aliases.

Speaking of RFC 9421, which notable fediverse implementations can't handle it yet? Anyone keeping track?

]]>https://bb.devnull.land/topic/df4cb618-ecdb-4f6d-80ba-710f47fcfe86/could-be-potentially-nice-for-fediverse-server-testing-as-more-implementations-make-the-jump-to-final-rfc-9421-http-signatures.RSS for NodeMon, 06 Apr 2026 21:56:29 GMTMon, 06 Apr 2026 18:04:16 GMT60<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:15:42 GMT]]>@hazelnoot @fedify At the very least, Mastodon and Fedify (and by extension Hollo and Ghost) do. Outside of those I'm very unsure! I've seen @silverpill talk about it a bunch, so maybe Mitra supports it as well.

]]>https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116359360853924032https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116359360853924032Mon, 06 Apr 2026 19:15:42 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:14:00 GMT]]>@gabboman @fedify @julian I'm adding it to activitypub-bot this week. I'll send a link when it's up.

]]>https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116359354139111276https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116359354139111276Mon, 06 Apr 2026 19:14:00 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:12:54 GMT]]>

@evan Thanks for the response. I think how a given software does double-knocking is up to that software. It is not necessarily true that you have to store the result, but it is ideal. I am much too lazy to refactor a persistent cache and I just double-knock every time. 😛

But to start, those libraries need to be able to support both signature implementations as those libraries are already in-use by the majority of software that has not implemented RFC 9421 yet.

]]>https://bb.devnull.land/post/https://nokoto.org/user/3/replies/281https://bb.devnull.land/post/https://nokoto.org/user/3/replies/281Mon, 06 Apr 2026 19:12:54 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:11:59 GMT]]>@julian@fietkau.social ah, then no, NodeBB has no support yet. That's true though that there is a step-wise upgrade pattern.

Updating our HTTP Signature lib is part of our grant funded work so it'll get sorted out soon!

cc @evan@cosocial.ca @gabboman@gabboman.xyz

]]>https://bb.devnull.land/post/https://activitypub.space/post/1744https://bb.devnull.land/post/https://activitypub.space/post/1744Mon, 06 Apr 2026 19:11:59 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:11:30 GMT]]>

Speaking of RFC 9421, which notable fediverse implementations can't handle it yet? Anyone keeping track?

@julian@fietkau.social @fedify@hollo.social I'm honestly not aware of any that do support it yet...

]]>https://bb.devnull.land/post/https://void.lgbt/objects/f2f0d850-4b32-4e31-ad35-58ff862ee309https://bb.devnull.land/post/https://void.lgbt/objects/f2f0d850-4b32-4e31-ad35-58ff862ee309Mon, 06 Apr 2026 19:11:30 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:10:39 GMT]]>@gabboman@gabboman.xyz are you coding typescript?

NodeBB is plain js. C'mon you don't need type safety. Code like its the 2000s.

]]>https://bb.devnull.land/post/https://activitypub.space/post/1743https://bb.devnull.land/post/https://activitypub.space/post/1743Mon, 06 Apr 2026 19:10:39 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 19:06:52 GMT]]>@mradcliffe The thing about double-knocking is that it requires two implementations (RFC 9421, draft-cavage-12). It also requires a persistent cache, so once you figure out which signature system the remote server supports, you only use that one -- you don't double-knock every time. It might not work as a library.

]]>https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116359326146804499https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116359326146804499Mon, 06 Apr 2026 19:06:52 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:59:17 GMT]]>

@evan @julian@fietkau.social @julian@activitypub.space  I think organizing a contribution event to refactor @peertube/http-signature and golang’s httpsig or gotosocial's fork of httpsig to support both cavage-12 and RFC9421 would go a long way to getting this done sooner as most of the software missing implementation depend on those libraries.

]]>https://bb.devnull.land/post/https://nokoto.org/user/3/posts/899https://bb.devnull.land/post/https://nokoto.org/user/3/posts/899Mon, 06 Apr 2026 18:59:17 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:51:48 GMT]]>@fedify@hollo.social @julian@fietkau.social

excelent

]]>https://bb.devnull.land/post/https://gabboman.xyz/fediverse/post/a9236dc1-0cbf-4e74-b54a-aae27190b7f6https://bb.devnull.land/post/https://gabboman.xyz/fediverse/post/a9236dc1-0cbf-4e74-b54a-aae27190b7f6Mon, 06 Apr 2026 18:51:48 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:49:14 GMT]]>@gabboman @fedify Fedify does it in TypeScript, as for vanilla JavaScript I have no idea.

]]>https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116359256770187966https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116359256770187966Mon, 06 Apr 2026 18:49:14 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:47:50 GMT]]>@fedify@hollo.social @julian@fietkau.social

I still cant! but I wonder, any example of a software in node/javascript that uses the new signature standard?

]]>https://bb.devnull.land/post/https://gabboman.xyz/fediverse/post/98595eb6-95eb-455e-b140-eab1ca961e94https://bb.devnull.land/post/https://gabboman.xyz/fediverse/post/98595eb6-95eb-455e-b140-eab1ca961e94Mon, 06 Apr 2026 18:47:50 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:46:05 GMT]]>@julian@fietkau.social @julian@activitypub.space Honestly, I think it's going to be a while.

I think the term for step 3 is "double knocking", and it's called out in the HTTP Signature report for the Social CG:

https://swicg.github.io/activitypub-http-signature/

]]>https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116359244354505014https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116359244354505014Mon, 06 Apr 2026 18:46:05 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:42:47 GMT]]>@julian@activitypub.space As I understand the migration path, it's like

1. Able to receive RFC 9421 in addition to draft-cavage
2. Able to send RFC 9421 in addition to draft-cavage
3. Send RFC 9421 by default, but be able to fall back to draft-cavage if needed

So by “can't handle” I meant step 1. 🙂 Although the unspoken step 4 is to remove draft-cavage support once everyone else has taken step 1, I'm ultimately also wondering when we'll get there.

]]>https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116359231424348338https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116359231424348338Mon, 06 Apr 2026 18:42:47 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:36:58 GMT]]>@julian@fietkau.social by "can't handle" do you mean "still reliant on cavage-12"?

🙋‍♂️

]]>https://bb.devnull.land/post/https://activitypub.space/post/1742https://bb.devnull.land/post/https://activitypub.space/post/1742Mon, 06 Apr 2026 18:36:58 GMT<![CDATA[Reply to Could be potentially nice for fediverse server testing, as more implementations make the jump to final RFC 9421 HTTP signatures. on Mon, 06 Apr 2026 18:27:02 GMT]]>

Speaking of RFC 9421, which notable fediverse implementations can't handle it yet? Anyone keeping track?

The last time I checked, Lemmy, GoToSocial, Friendica, and the ‘keys to name a few did not handle it. Mastodon didn’t if you included requiring ed25519. But I haven’t checked the code bases or my logs in a month or two, @julian. At that time there wasn’t much progress on peertube/http-signatures or superseriousbusiness/httpsig.

I should probably check again...

]]>https://bb.devnull.land/post/https://nokoto.org/user/3/posts/898https://bb.devnull.land/post/https://nokoto.org/user/3/posts/898Mon, 06 Apr 2026 18:27:02 GMT