<p>A couple days ago, I got a DM from a <a href="/tags/bonfire/" rel="tag">#Bonfire</a> user. I happily replied and senta follow request—but the Accept never came back, even though they hadn'tenabled manuallyApprovesFollowers. My DM reply probably never arrived either. Classic interop bug.</p><p>I checked out the Bonfire source and dug in. Turns out Bonfire hasn't implemented <a href="https://www.rfc-editor.org/rfc/rfc9421" rel="nofollow">RFC 9421</a> yet, so it was silently discarding any activity signed with it. That alone would be workable, except for one more issue: Bonfire was responding 200 OK even when signature verification failed, instead of 401 Unauthorized.</p><p>This matters because <a href="https://fedify.dev/manual/send#double-knocking-http-signatures" rel="nofollow">Fedify implements</a> a <a href="https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions" rel="nofollow">double-knocking mechanism</a>—if a request signed with RFC 9421 fails, it retries with the older draft cavage signature. But since Bonfire returned 200 OK on the failed first knock, <a href="/tags/fedify/" rel="tag">#Fedify</a> had no reason to send a second one.</p><p>I filed two issues on the Bonfire <a href="/tags/activitypub/" rel="tag">#ActivityPub</a> repo—one requesting <a href="https://github.com/bonfire-networks/activity_pub/issues/7" rel="nofollow">RFC 9421 support</a>, and one about <a href="https://github.com/bonfire-networks/activity_pub/issues/8" rel="nofollow">returning 401 on invalid signatures</a>. For the latter, I also sent a PR, which got merged pretty quickly: <a href="https://github.com/bonfire-networks/activity_pub/pull/9" rel="nofollow">bonfire-networks/activity_pub#9</a>.</p><p>That said, individual Bonfire instances won't pick up the fix until they actually deploy it. So in the meantime, I patched <a href="https://github.com/fedify-dev/hollo/commit/a883fd1b2158463b1ceb7894e2084d598bfaabc4" rel="nofollow">Hollo</a> and <a href="https://github.com/hackers-pub/hackerspub/commit/02de643c709984b016bc92c4a18c1c284a59c49a" rel="nofollow">Hackers' Pub</a> to use draft-cavage-http-signatures-12 as the <a href="https://fedify.dev/manual/federation#firstknock" rel="nofollow">firstKnock</a>, so Bonfire instances can at least understand the first request.</p><p>One last thing: Fedify caches whether a given server supports RFC 9421, and the Bonfire servers I'd already talked to were cached as “supports RFC 9421”—because they'd been returning 200 OK. I had to manually clear that cache on both hollo.social and hackers.pub before everything finally worked.</p><p>After all that, the mutual follow went through and my DM reply landed. Worth it.</p><p><a href="/tags/fedidev/" rel="tag">#fedidev</a> <a href="/tags/fediverse/" rel="tag">#fediverse</a> <a href="/tags/hollo/" rel="tag">#Hollo</a> <a href="/tags/hackerspub/" rel="tag">#HackersPub</a></p>
Edited 41d ago
