Outgoing RFC 9421 Signatures

Previously, I mentioned that support for incoming RFC 9421 signatures was added to Irwin for inbox deliveries. A week ago, I finished implementing outgoing signatures for both inbox deliveries and “authorized fetch” GET requests. So, how does it know whether to send a legacy signature or a new RFC 9421 signature? In general, the double-knocking technique: First, try generating or verifying an HTTP Signature with one version, ideally (but not necessarily) the latest. If the remote server rejects that signature, eg with an HTTP 401 response, or the incoming signature doesn’t verify, try with another version. Repeat until a signature passes or you’ve tried all supported versions. (Many fediverse servers do process incoming activities asynchronously, but they generally still verify signatures synchronously, so double knocking is still viable when delivering activities to remote inboxes.) So, first try RFC 9421 and if that returns a 401, then retry with the legacy signature. However, Irwin…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town