0 Fork 0

T

thepraandClaude Opus 5.5 c5a69d240a RFC 9421 signatures are verified, not refused

WordPress's ActivityPub plugin (and Ghost and Fedify) sign with RFC 9421
first and fall back to draft-cavage only after a refusal, so each first
delivery cost two requests and a 401 in our statistics. Now a request
carrying Signature-Input is verified as an HTTP message signature: its
covered components (the method and our own public target, the body's
Content-Digest), its created and expires, with the actor's RSA key under
PKCS#1 v1.5 or PSS. Deliveries and signed fetches both take it; the
ledger names the scheme (rfc9421:rsa-v1_5-sha256). What PrivaPub sends
stays draft-cavage, which every server reads. Ed25519 waits for FEP-521a
keys.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

2026-10-05 06:48:22 +02:00

.gitea/workflows

Everything on, phase 2 completed: SecureMode on in production, checked by the deploy

2026-10-04 03:34:48 +02:00

deploy

Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra , the crawler is on, sign-up by invitation

2026-10-04 02:37:38 +02:00

docs

RFC 9421 signatures are verified, not refused

2026-10-05 06:48:22 +02:00

PrivaPub

RFC 9421 signatures are verified, not refused

2026-10-05 06:48:22 +02:00

PrivaPub.ClientModels

Reports and statistics answer in ClientModels' shapes

2026-10-05 05:32:32 +02:00

PrivaPub.Tests

RFC 9421 signatures are verified, not refused

2026-10-05 06:48:22 +02:00

tools

A community's moderators lock threads and ban members

2026-10-05 06:10:33 +02:00

.gitignore

The town: a fake community across the pasture, checked for coherence

2026-10-05 00:32:54 +02:00

CLAUDE.md

RFC 9421 signatures are verified, not refused

2026-10-05 06:48:22 +02:00

Directory.Build.props

net10, the refactor finished, and federation that works

2026-10-01 08:05:56 +02:00

FEDERATION.md

RFC 9421 signatures are verified, not refused

2026-10-05 06:48:22 +02:00

global.json

net10, the refactor finished, and federation that works

2026-10-01 08:05:56 +02:00

LICENSE

Initial commit

2023-02-18 08:50:05 +01:00

PrivaPub.sln

Every outbound federation request goes through one guarded client

2026-10-01 10:46:09 +02:00

README.md

CLAUDE.md, a README, and the roadmap to full ActivityPub interop

2026-10-01 10:38:35 +02:00

README.md

PrivaPub

A self-hosted ActivityPub server in C# (.NET 10, MongoDB) where one private login owns several unlinkable public personas. It federates with Mastodon, GoToSocial, Pleroma/Akkoma, Misskey and Lemmy.

Live: https://privapub.thepra.dev
Client: decePubClient, https://decepub.thepra.dev
Architecture, conventions and deploy: CLAUDE.md
Decisions and the plan to full ActivityPub interop: docs/ROADMAP.md

dotnet build PrivaPub.sln -c Release