<![CDATA[Tracking RFC 9421 Adoption]]>One of the big pain points for ActivityPub developers is supporting HTTP Signature in their servers. The Fediverse uses an out-dated draft standard, draft cavage 12. There's a helpful ActivityPub and HTTP Signatures report from the SocialCG, but it's still kind of a slog.

Some server software has begun the pivot to using double-knocking, capability discovery, or something else.

To track support for RFC 9421, I added an adoption matrix to the ActivityPub HTTP Signature repo. I grabbed all the software listed on FediDB, and laid out a matrix of whether it accepts RFC 9421 signatures for GET and POST or sends RFC 9421 for GET and POST. I also included a way to find relevant bug-tracker issues.

https://swicg.github.io/activitypub-http-signature/RFC9421

It would be a huge help to get some more eyes and data on this adoption matrix. If you know about a Fediverse server package's support for RFC 9421, including your own, please make a PR against the RFC9421.md file in the swicg/activitypub-http-signature repo.

Thanks!

]]>https://fedi.wiki/topic/ca39aa21-c7a2-4345-a2e5-d5d510ee64cd/tracking-rfc-9421-adoptionRSS for NodeTue, 25 Aug 2026 08:06:56 GMTSun, 16 Aug 2026 18:11:05 GMT60<![CDATA[Reply to Tracking RFC 9421 Adoption on Mon, 17 Aug 2026 17:18:00 GMT]]>I will say that adoption of RFC 9421 is a more difficult than anticipated because many of us hacked our cavage-12 implementations in by testing against Mastodon.

Specifically, I remember a very old (and outdated even then!) blog post by @gargron@mastodon.social about how Signatures were implemented by Mastodon, and that formed the basis of how NodeBB signed its messages.

I'm glad we're moving on but I think for the majority of us, having a reliable library to do the heavy lifting is important.

Don't roll your own HTTP signatures folks!

]]>https://fedi.wiki/post/https://activitypub.space/post/2367https://fedi.wiki/post/https://activitypub.space/post/2367Mon, 17 Aug 2026 17:18:00 GMT