When distributing comments downstream, send the original LD-signature signed...
When distributing comments downstream, send the original LD-signature signed activity (signed by the original author) if we have it. The HTTPSignature will be signed by the sending channel. It isn't certain Mastodon can handle an activity with both an author and a sender signature; where the author and sender are different. Initial tests were inconclusive and the results inconsistent. The federation delivery model is supported by ActivityPub and there are only two possible ways to make it work in the absence of clear guidance in the spec. This is the right way(*) and is the way we will be doing it when we can. There are many situations where we will be forced to drop the message because the author may come from a different network or the ActivityPub driver isn't installed and they didn't provide us with an LD-signed activity to work with. (*)The right way would also use a consistent and reliable signature algorithm, but this is the hand we were dealt.
Showing with 28 additions and 11 deletions