Files
indiekit-endpoint-activitypub/package.json
Ricardo 4298a6a307 fix: remove RSA Multikey from assertionMethod to fix tags.pub signature verification
The Fedify 2.0 migration added assertionMethods = keyPairs.map(k => k.multikey),
which places the RSA Multikey (id: #main-key) into assertionMethod alongside the
Ed25519 Multikey (id: #key-2).

This creates a keyId collision: the RSA CryptographicKey in publicKey and the RSA
Multikey in assertionMethod both use #main-key. Servers that traverse JSON-LD
properties alphabetically (assertionMethod before publicKey) find the Multikey
first — which lacks publicKeyPem — and return "public key not found".

Fix: filter assertionMethods to only Ed25519 keys (Object Integrity Proofs).
RSA keys already have their correct representation in publicKey (HTTP Signatures).
This matches Mastodon's behavior and is semantically correct per the two key systems.
2026-03-22 15:31:29 +01:00

58 lines
1.4 KiB
JSON

{
"name": "@rmdes/indiekit-endpoint-activitypub",
"version": "3.8.3",
"description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
"keywords": [
"indiekit",
"indiekit-plugin",
"indieweb",
"activitypub",
"fediverse",
"federation",
"fedify"
],
"author": {
"name": "Ricardo Mendes",
"url": "https://rmendes.net"
},
"license": "MIT",
"engines": {
"node": ">=22"
},
"type": "module",
"main": "index.js",
"exports": "./index.js",
"files": [
"assets",
"lib",
"locales",
"views",
"index.js"
],
"repository": {
"type": "git",
"url": "https://github.com/rmdes/indiekit-endpoint-activitypub"
},
"bugs": {
"url": "https://github.com/rmdes/indiekit-endpoint-activitypub/issues"
},
"dependencies": {
"@fedify/debugger": "^2.0.0",
"@fedify/fedify": "^2.0.0",
"@fedify/redis": "^2.0.0",
"@js-temporal/polyfill": "^0.5.0",
"express": "^5.0.0",
"ioredis": "^5.9.3",
"sanitize-html": "^2.13.1",
"unfurl.js": "^6.4.0"
},
"peerDependencies": {
"@indiekit/endpoint-micropub": "^1.0.0-beta.25",
"@indiekit/error": "^1.0.0-beta.25",
"@indiekit/frontend": "^1.0.0-beta.25"
},
"publishConfig": {
"access": "public"
}
}