Edent, 4 months ago

It is rather frustrating that there's no way to verify #HTTP signatures online if they contain "(request-target)".

The #Mastodon #ActivityPub server is responding to my server's "Accept" POST with "Verification failed".

As far as I can tell, my signature is valid. It uses the same generation code as other servers as far as I can tell.

This might be a 3-drink problem!

benpate, 4 months ago

@Edent HTTP signatures are the worst. I’m so sorry you’re struggling with this. They’re so delicate, I can’t offer any help aside from the standard “break everything down into tiny steps, then test with known data at every step along the way.” Hopefully, something sticks out.

For me, HTTP sigs easily accounted for 1/3 of the overall pain of implementing ActivityPub. JSON-LD is another 1/3, btw…

So the (good news?) is that once you cross this hurdle, you’re VERY close. I’m rooting for you!

Edent, 4 months ago

@benpate Thanks! Do you have any code I could look at?
I'm comparing PHP and Python at the moment. No obvious mistakes.

benpate, 4 months ago

@Edent Hey Terence, I’m so sorry, I just saw this notification now. I’m working in Go, so my code may not be that useful to you. But in case it is:

All my ActivityPub code is here: https://github.com/benpate/hannibal
And my HTTP Signature code is here: https://github.com/benpate/hannibal/tree/main/sigs

Hopefully, some of my test cases will be useful for you :)
Let me know if anything pops out where I can help you out.

thisismissem, 4 months ago

@Edent could it be an issue with padding (the = signs)

thisismissem, 4 months ago

@Edent if you can read ruby, the logic is here: https://github.com/mastodon/mastodon/blob/main/app/controllers/concerns/signature_verification.rb

Edent, 4 months ago

@thisismissem
Thanks!
Turns out it was PEBCAK. I was using my path rather than the remote path.
Perhaps I should have stuck to one drink 😄

naturzukunft, 4 months ago

@Edent https://funfedi.dev/testing_tools/http_signatures/ helps me to fix some bugs. At least it was successful. But the mastodon error is the same 😀 i need anybody with an mastodon instance who has access to its logfiles.

naturzukunft, 4 months ago

@Edent also nice to follow: https://socialhub.activitypub.rocks/t/anyone-have-a-http-signatures-test-case/3845

Edent, 4 months ago

@naturzukunft
Brilliant, thanks!

bencurthoys, 4 months ago

@Edent I'd look for an unescaped [ character in one of the values being parsed as the start of a new header name.

naturzukunft, 4 months ago

@Edent The headername are also in the signature? Maybe the error occurs after extracting them ?

Edent, 4 months ago

@naturzukunft
Good point, I'll try that. Thanks.

paul, 4 months ago

deleted_by_author

Edent, 4 months ago

@paul
In the kindest possible way - if you don't understand the question, please don't feel compelled to guess.

sil, 4 months ago

@Edent try making the header names lower case? that ought to not be the problem, but occasionally I've seen things moan about it. Unlikely to be the issue with something as widely deployed as mastodon though!