Elektrine
Log in Register

#fedbox

3 posts · Last used 16d

Back to Timeline
julian
julian @julian@activitypub.space · Jul 29, 2026

Reflecting on the existence of httpsig.org

<p><a href="http://httpsig.org/" rel="nofollow ugc">httpsig.org</a> is a site with one sole purpose, to advocate for the adoption of <a href="https://www.rfc-editor.org/rfc/rfc9421.html" rel="nofollow ugc">RFC 9421 HTTP Signatures</a>. It has a "Libraries" tab that does exactly what it advertises, it lists a bunch of libraries for you to use so you don't have to roll your own.</p> <p>If you want to integrate AP today, but you don't want to roll your own everything, where do you go? Who do you ask?</p> <p>All I know is:</p> <ul> <li><a href="https://fedify.dev/" rel="nofollow ugc">Fedify</a> → Typescript (thanks <a href="https://hollo.social/@hongminhee">@<bdi>hongminhee@hollo.social</bdi></a>!)</li> <li><a href="https://github.com/go-ap/fedbox" rel="nofollow ugc">FedBOX</a> → Go (thanks <a href="https://metalhead.club/@mariusor">@<bdi>mariusor@metalhead.club</bdi></a>!)[...]</li></ul> Hover or focus to reveal Sensitive
httpsig.org is a site with one sole purpose, to advocate for the adoption of RFC 9421 HTTP Signatures. It has a "Libraries" tab that does exactly what it advertises, it lists a bunch of libraries for you to use so you don't have to roll your own. If you want to integrate AP today, but you don't want to roll your own everything, where do you go? Who do you ask? All I know is: Fedify → Typescript (thanks @hongminhee@hollo.social!) FedBOX → Go (thanks @mariusor@metalhead.club!)[...] Do we even have a list sorted by language? This would be huge. What other AP frameworks do you know of? Granted, I didn't do a lot of thinking and deep diving before I listed those two examples, but even then, that's 1 more example than is listed on https://activitypub.rocks so I think I might be on to something here from a developer advocacy point of view. If I were looking to integrate AP, one of the first conclusions I'd come to is that the protocol itself is fairly complex and a library or framework might help. I don't think there is a list that plainly lists supported libraries by language.
0
6
0
mariusor
marius @mariusor@metalhead.club · Jul 29, 2026
I'm surprised at how many issues my new integration tests are finding. I already had an integration testsuite, but the way the #fedbox application was run was not in full isolation, and I expect some of the setup steps I had included don't really exist on a fresh install. We now build a fresh container image, start it up, provision it with mock data, and then run tests, but only through mechanisms that are available to a prospective server operator: CLI commands executed through SSH, and ActivityPub client to server operations. #fedidev #activityPubDev #activitypub
3
1
4
Marius @Marius@marius.federated.id · Apr 30, 2026
Huzzah!! After about a little less than one month I have managed to deploy the new versions of the #GoActivityPub libraries containing RFC9421 for both outbound request signing and inbound verification, to both #FedBOX and #ONI. During this tme we contributed to another Go module to add support for our use cases, then we ended up replacing it all together with another one having a simpler API. In the process I managed to simplify the go-ap/auth module to contain only the verifiers for OAuth and HTTP-Signatures (in both draft and RFC compatible flavours). This post is in fact, the first one that uses them for remote dissemination, and if you see it on your timeline it doesn’t neccessarily mean that your instance supports this signature type, but rather that the “double knocking” mechanism of retrying with the old draft version is functional. Here’s to hoping it won’t be needed for much longer. 🥂
0
3
0

You've seen all posts