live example (actix-web) cant receive activities from mastodon with Error(Incoming activity has invalid signature)

[CutestNekoAqua]

Hi, I played a bit with the example code and replaced axum with actix-web in the live example. The user can be fetched but no matter what fediverse software I try federating with (mastodon, glitch, firefish, akkoma) it all fails at verification of the incoming activity. The culprit code is here

[CutestNekoAqua]

There might be a bug in my code, but I am not 100%-ly sure and being at this stuck for at least two hours now makes me wonder if this is related to Mastodon having a bug in its signing code. And this check being bug-free ;')

Link to my version of the example code: https://github.com/lysand-org/lysand-ap-layer

[Nutomic]

Lemmy uses the same code and can federate with Mastodon just fine. So I doubt that there is a bug in the library or in Mastodon. Is it possible that its verifying with the wrong public key for some reason?

[CutestNekoAqua]

Lemmy uses the same code and can federate with Mastodon just fine. So I doubt that there is a bug in the library or in Mastodon. Is it possible that its verifying with the wrong public key for some reason?

I mean, im not even sure about how the lib even gets any public key. Afaik thats not clearly documented in the example. I guess you mean, that the local instance is started with the wrong public key?

[Nutomic]

The incoming activity is handled here and here. So the actor is retrieved with ActivityHandler.actor(), that gets dereference()d and then it calls actor.public_key_pem().

Stepping through with a debugger is not really practical with a web server, instead you can clone this library and pull it in as a path dependency. That way you can add debug statements in the code to see what exactly it is doing, and if the values are as expected.

Another problem I had recently with receiving activities was that the nginx config didnt set the Host header. Its important that this matches the federation domain as its part of the signature. Also its best to ensure that your project can federate with itself before federating with another platform. That way problems are much easier to debug.

[CutestNekoAqua]

Another problem I had recently with receiving activities was that the nginx config didnt set the Host header. Its important that this matches the federation domain as its part of the signature

that was the call I needed! Thanks!

[Technohacker]

I stumbled upon this error in a subtly different way, and I figured I'd add to this issue for archival purposes:

I'm using axum and my inbox endpoint is at /user/<user id>/inbox, but the message to be validated was as follows:

key
 -----BEGIN PUBLIC KEY-----
 (correct key)
 -----END PUBLIC KEY-----

message
 host: (correct hostname)
 date: (correct time)
 digest: (valid SHA256 signature)
 content-type: application/activity+json
 (request-target): post /abc/inbox

It took me a while before I noticed that the problem was the (request-target). The /user/ prefix was missing. I'd known axum's nested Routers would do such a thing, but I didn't realize the extractor within ActivityData was using the stripped URL.

Un-nesting the Router (for now), fixes the signature check. Maybe ActivityData could use OriginalUri instead, but I feel that might introduce SemVer-breaking behaviour.

[Nutomic]

@Technohacker Feel free to make a pull request for that, and I will leave it as draft until the next major version is ready.

[Technohacker]

@Nutomic Sure! I'll get a PR ready in a bit :)