0 Fork 0

T

thepraandClaude Opus 5.5 611abb5857 Inbound signatures must be fresh and cover the request line and host

S6 of the roadmap. An inbox POST is refused unless its signature covers
(request-target) and host, as well as the digest and a date or (created).
The Date or (created) may be at most an hour old and fifteen minutes ahead
(it was twelve hours either way), and an (expires) in the past is refused.
The request target is read raw from the server, so a percent-encoded path
verifies as the sender signed it.

Tests cover a Mastodon-shaped delivery and each way of tampering with it,
plus a round trip of our own outbound signature.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

2026-10-01 10:51:10 +02:00

.gitea/workflows

Every outbound federation request goes through one guarded client

2026-10-01 10:46:09 +02:00

deploy

net10, the refactor finished, and federation that works

2026-10-01 08:05:56 +02:00

docs

CLAUDE.md, a README, and the roadmap to full ActivityPub interop

2026-10-01 10:38:35 +02:00

PrivaPub

Inbound signatures must be fresh and cover the request line and host

2026-10-01 10:51:10 +02:00

PrivaPub.ClientModels

net10, the refactor finished, and federation that works

2026-10-01 08:05:56 +02:00

PrivaPub.Tests

Inbound signatures must be fresh and cover the request line and host

2026-10-01 10:51:10 +02:00

.gitignore

Initial commit

2023-02-18 08:50:05 +01:00

CLAUDE.md

Move the federation code under Federation/, namespaces only

2026-10-01 10:39:41 +02:00

Directory.Build.props

net10, the refactor finished, and federation that works

2026-10-01 08:05:56 +02:00

global.json

net10, the refactor finished, and federation that works

2026-10-01 08:05:56 +02:00

LICENSE

Initial commit

2023-02-18 08:50:05 +01:00

PrivaPub.sln

Every outbound federation request goes through one guarded client

2026-10-01 10:46:09 +02:00

README.md

CLAUDE.md, a README, and the roadmap to full ActivityPub interop

2026-10-01 10:38:35 +02:00

README.md

PrivaPub

A self-hosted ActivityPub server in C# (.NET 10, MongoDB) where one private login owns several unlinkable public personas. It federates with Mastodon, GoToSocial, Pleroma/Akkoma, Misskey and Lemmy.

Live: https://privapub.thepra.dev
Client: decePubClient, https://decepub.thepra.dev
Architecture, conventions and deploy: CLAUDE.md
Decisions and the plan to full ActivityPub interop: docs/ROADMAP.md

dotnet build PrivaPub.sln -c Release