#signatures

Dismissing HTTP Signature on presence of Object Integrity Proof I have a question for implementors pursuing object integrity proofs. I am implementing the ability to serve these proofs in NodeBB with the assistance of an LLM. It is adhering to @silverpill@mitra.social's FEP-8b32: Object Integrity Proofs. As part of its work, it implemented a quirk I thought was curious. If the proof was present in an embedded object, the activity's HTTP signature was ignored/not-checked. I challenged the model and it pointed to this line from the FEP... If both HTTP signature and integrity proof are used, the integrity proof MUST be given precedence over HTTP signature. The HTTP signature MAY be dismissed. ... and cited potential interop if someone were to send an activity with integrity proof but explicitly no HTTP signature. That is, if NodeBB were to implement a hard requirement for HTTP signatures, then that specific case would fail inbound checks. My rationale is: The HTTP signature guarantees that the payload has not been modified in-transit, and The proof guarantees the authenticity of the payload, and This is doubly so for payloads belonging to separate origins Am I incorrect? It would seem like we need to exercise both checks to ensure authenticity of the entire payload chain: activity and object. Pinging other interested parties: @hongminhee@hollo.social @mike@macgirvin.com @pfefferle@mastodon.social @evan@cosocial.ca