Re: @peertube/http-signature

2026-05-13 17:24 UTC

@Chocobozzz@framapiaf.org I have a question for you... I'm seeing in Are we HS2019 yet? that Peertube and Misskey both use your package: @peertube/http-signature NodeBB currently rolls its own cavage-12 support but and I did some preliminary research into updating to the latest HTTP Signatures draft, but quickly got overwhelmed. For a variety of reasons, but mainly to avoid NIH, I'd consider switching to a dependency. My question is: does your library support verification for non-hs2019 signatures, or will I need to invoke your library in front, and fall back to existing cavage-12 verification otherwise? I suppose, same question re: double-knocking.[...]

Replies (2)

@chocobozzz@activitypub.space 2026-05-15 12:51

Hi, My answer seems to not have been received here so I copy the link: https://framapiaf.org/@Chocobozzz/116577305060483143

Open ##2567700
@Chocobozzz@framapiaf.org 2026-05-15 07:01

@julian Hi, In fact peertube doesn't use this library anymore. We switched to https://github.com/misskey-dev/node-http-message-signatures Ironically, Misskey still uses @peertube@framapiaf.org/http-signature. The former dev of @misskey-dev/node-http-message-signatures expressed concerns about the maintenance status of the library: https://github.com/Chocobozzz/PeerTube/issues/7372 However, upon reviewing it, I found no issues or security considerations with the library. @peertube@framapiaf.org/http-signature (based on https://github.com/TritonDataCenter/node-http-signature) isn't really maintained either

Open ##3288573