RFC9421 support in Fedipub

We’ve just released Fedipub v0.10.0, which adds support for RFC9421 HTTP signatures. By default, all outgoing requests are now signed with RFC9421, and incoming messages signatures are verified for correctness if present.

For a long time, Fediverse apps have tended to run a much older draft version of HTTP signatures, draft-cavage-http-signatures-12. While that works, and is important for interoperability, RFC9421 is more future-proof, and is of course a finalised standard, so it makes sense to move. Only problem is, getting every Fediverse app to move over is a big job, and we have to manage in an environment where both signature methods are in active use.

The ActivityPub and HTTP Signatures report looked at this in 2024 and proposed a way forward, with an approach called “double knocking”, which is what we’ve implemented. For outgoing messages, we sign with RFC9421 first, and then if a 4xx error is received, try again with draft-cavage-http-signatures-12. For incoming messages, we verify whichever is present; currently signatures aren’t required though - that will be an option in a future release.

It’s all completely transparent, you won’t need to make any changes to your applications. Instead, it’s a silent upgrade to security that you won’t really notice, and apps using Fedipub will get the benefits for free. So, from this version on, Fedipub apps will get a tick on the adoption tracker; we’re proud to be part of that effort towards better security!

HTTP signatures are probably the most complex part of working with ActivityPub and can be hard to test, so if you come across anything strange or notice any bugs, please file an issue and we’ll get it looked into as soon as we can!