mastodon - Plural Café fork of Mastodon/Glitch Social

Age	Commit message (Collapse)	Author
2018-06-30	Typo in signature verification failure logging (#7916)	Marty McGuire
	`@signature_verification_failure_reason` is used in most places but`@signed_verification_failure_reason` appears in two places. Likely those errors are not returned.
2018-05-17	HTTP signatures spec no longer requires algorithms field (#7525)	Eugen Rochko
	Fix #7520
2018-01-22	Rename ResolveRemoteAccountService to ResolveAccountService (#6327)	Akihiko Odaki
	The service used to be named ResolveRemoteAccountService resolves local accounts as well.
2017-10-04	Validate id of ActivityPub representations (#5114)	Akihiko Odaki
	Additionally, ActivityPub::FetchRemoteStatusService no longer parses activities. OStatus::Activity::Creation no longer delegates to ActivityPub because the provided ActivityPub representations are not signed while OStatus representations are.
2017-10-03	Fix HTTP responses for salmon and ActivityPub inbox processing (#5200)	ThibG
	* Return sensible HTTP status for ActivityPub inbox processing * Return sensible HTTP status for salmon slap processing * Return additional information to debug signature verification failures
2017-09-28	If HTTP signature is wrong and webfinger cache is stale, retry with resolve ↵	Eugen Rochko
	(#5129) If the signature could not be verified and the webfinger of the account was last retrieved longer than the cache period, try re-resolving the account and then attempting to verify the signature again
2017-08-21	Support more variations of ActivityPub keyId in signature (#4630)	Eugen Rochko
	- Tries to avoid performing HTTP request if the keyId is an actor URI - Likewise if the URI is a fragment URI on top of actor URI - Resolves public key, returns owner if the owner links back to the key
2017-08-09	Add Digest header to requests with body, handle acct and URI keyId (#4565)	Eugen Rochko

2017-07-14	HTTP signatures (#4146)	Eugen Rochko
	* Add Request class with HTTP signature generator Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06 * Add HTTP signature verification concern * Add test for SignatureVerification concern * Add basic test for Request class * Make PuSH subscribe/unsubscribe requests use new Request class Accidentally fix lease_seconds not being set and sent properly, and change the new minimum subscription duration to 1 day * Make all PuSH workers use new Request class * Make Salmon sender use new Request class * Make FetchLinkService use new Request class * Make FetchAtomService use the new Request class * Make Remotable use the new Request class * Make ResolveRemoteAccountService use the new Request class * Add more tests * Allow +-30 seconds window for signed request to remain valid * Disable time window validation for signed requests, restore 7 days as PuSH subscription duration (which was previous default due to a bug)