Commit 548dd161 authored by Zot's avatar Zot

When distributing comments downstream, send the original LD-signature signed...

When distributing comments downstream, send the original LD-signature signed activity (signed by the original author) if we have it. The HTTPSignature will be signed by the sending channel. It isn't certain Mastodon can handle an activity with both an author and a sender signature; where the author and sender are different. Initial tests were inconclusive and the results inconsistent. The federation delivery model is supported by ActivityPub and there are only two possible ways to make it work in the absence of clear guidance in the spec. This is the right way(*) and is the way we will be doing it when we can. There are many situations where we will be forced to drop the message because the author may come from a different network or the ActivityPub driver isn't installed and they didn't provide us with an LD-signed activity to work with. (*)The right way would also use a consistent and reliable signature algorithm, but this is the hand we were dealt.
parent 2c19ecae
......@@ -1211,6 +1211,9 @@ function as_create_note($channel,$observer_hash,$act) {
$s['item_private'] = 1;
set_iconfig($s,'activitypub','recips',$act->raw_recips);
if($parent) {
set_iconfig($s,'activitypub','rawmsg',$act->raw,1);
}
$r = q("select created, edited from item where mid = '%s' and uid = %d limit 1",
dbesc($s['mid']),
......
......@@ -371,6 +371,8 @@ function pubcrawl_notifier_process(&$arr) {
return;
}
$signed_msg = null;
if(array_key_exists('target_item',$arr) && is_array($arr['target_item'])) {
if(intval($arr['target_item']['item_obscured'])) {
......@@ -388,12 +390,19 @@ function pubcrawl_notifier_process(&$arr) {
return;
}
// AP does not allow any messages where the sender is different from the actor
$signed_msg = get_iconfig($arr['target_item'],'activitypub','rawmsg');
// If we have an activity already stored with an LD-signature
// which we are sending downstream, use that signed activity as is.
// The channel will then sign the HTTP transaction.
// It is unclear if Mastodon supports the federation delivery model. Initial tests were
// inconclusive and the behaviour varied.
if($arr['channel']['channel_hash'] != $arr['target_item']['author_xchan']) {
if(($arr['channel']['channel_hash'] != $arr['target_item']['author_xchan']) && (! $signed_msg)) {
return;
}
}
......@@ -412,16 +421,21 @@ function pubcrawl_notifier_process(&$arr) {
$prv_recips = $arr['env_recips'];
$msg = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
z_root() . ZOT_APSCHEMA_REV
]], asencode_activity($target_item));
$msg['signature'] = \Zotlabs\Lib\LDSignatures::dopplesign($msg,$arr['channel']);
$jmsg = json_encode($msg, JSON_UNESCAPED_SLASHES);
if($signed_msg) {
$jmsg = $signed_msg;
}
else {
$msg = array_merge(['@context' => [
ACTIVITYSTREAMS_JSONLD_REV,
'https://w3id.org/security/v1',
z_root() . ZOT_APSCHEMA_REV
]], asencode_activity($target_item));
$msg['signature'] = \Zotlabs\Lib\LDSignatures::dopplesign($msg,$arr['channel']);
$jmsg = json_encode($msg, JSON_UNESCAPED_SLASHES);
}
if($prv_recips) {
$hashes = array();
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment