Unify verification for ActivityPub-compatible platforms

austin

Mastodon is done by fetching the ActivityPub profile page, so supporting other ActivityPub-compatible format can be done the same way.

Now, each platform has a different format for profile URLs and is not necessarily composed of the username (eg. Misskey, where the ActivityPub endpoint uses user ID), which can be fetched through Webfinger (refer to Mastodon docs). So two requests and it should support all ActivityPub platforms (fields first, and description as fallback), including Pleroma, Misskey, and Friendica.

For secure mode / authorized fetch instances, it is possible to imitate an ActivityPub server.

yarmo

Good research work!

I didn't know the webfinger could be used to obtain the profile URL. In hindsight, it makes a lot of sense!

We could already work on getting a universal AP verification method working. I'm reworking the Ariadne Spec so that we can allow multiple HTTP request and look for the identity proof in multiple locations, but again this doesn't need to delay the implementation.

Currently not able to look into that imitating an ActivityPub but glad to know it shouldn't be too complicated!

austin

yarmo It doesn't need to look for the identity proof in multiple locations as Webfinger is only used to obtain that one endpoint that has the identity proof. Fields + description is simply JSON fields.

Summary of imitating an ActivityPub server:

Generate a public/private key
Publish public key
Use private key to sign requests

yarmo

austin Summary of imitating an ActivityPub server:

Generate a public/private key
Publish public key
Use private key to sign requests

Most complicated part seems "publish public key", it probably needs to be located somewhere very specific but still, will be feasible.

We should try this out.

yarmo

Alright, time to stop messing around. Let's get this done.

I have the webfinger working to find the URL specific to each service provider. Some don't work yet because the request is not signed, will fix next.

But I'm thinking we probably need to create a new identity claim in the form of acct:XXX@YYY. This URI has its own RFC (which also includes the webfinger) and I think this is the way to support all possible fediverse servers.

https://www.rfc-editor.org/rfc/rfc7565.html

yarmo

Actually, never mind, I just found out webfinger is not a requirement for activitypub: https://socialhub.activitypub.rocks/t/what-would-make-ap-v2-0-a-complete-protocol/2107

In fact, it even has resistance. So it seems I'll just have to accept any URL and see if an application/activity+json request returns anything useful.

yarmo

Implemented!

https://blog.keyoxide.org/keyoxide-october-2022/#Universal_ActivityPub_claim_verification

Hilario

Thanks a lot yarmo for this! Well done!