Any #PHP #cryptography geeks out there? I'm working on doing something w/ the Fediverse, but every time I go to validate the signed headers, I get a big fat NO. I'm kinda stuck, I've tried three different approaches, and all three have dropped me at the same endpoint, I'm not sure what I'm doing wrong.
#codeHelp #fediHelp #OldDogNewTricks #WhatTheHellAmIDoingWrong
@jaycie So Fedi says you've got a public/private keypair for each Actor. You should be able to validate a message signed by said actor (signature is in the header) by retrieving the pubkey and doing some not-so-handwavy openssl shenanigans.
landrok/activitypub has this built into their HttpSignature class, but that fails every time for me. I've tried an approach for Bugle, and then I re-built that approach because there's a lot of duplicated code throughout it.
All three have been "NOPE INVALID" returns. I'm on week... 4? of this headache.
@jaycie I may just post an interim commit to my github repo and ask folks to peek at it. The concept is simple. Pull the signature out of the header. Pull the Actor's Public Key, do a validate call (Native to PHP).
And I'm just getting *fart noise*
@kboyd Hrm. I will need to look at the sort order, cause I am technically building the string that we're comparing the validator against.
The code for this is here: https://github.com/clickthulu/clickthulufed/blob/dev/activity-pub/src/Helpers/SignatureHelper.php
The problem is, even if I DID change the sort order, how would I know?
@kboyd Okay, so, sort order confirmed, it's the same as what it claims to expect. I'm not sure on quotes, because all the examples don't have quotes, and neither do I, but the data coming in does. BUT I've tried it with both quotes and no quotes and it's still no good.
I think I'm finding it especially annoying to debug because it's a bit of a black box. Insert data, get failure. Insert slightly different data, get failure. I've no way to figure out what's actually wrong, so it's kind of a shot in the dark each time.
https://github.com/clickthulu/clickthulufed/blob/dev/activity-pub/src/Helpers/SignatureHelper.php
Here's my cleaned up version of a validator, its always returning false
@phpfox Compare: "Can anyone do math?" vs "Can anyone tell me how to find x in y=mx+b?"
Asking your specific question will in general yield more & better responses.
Daemionfox
Jaycie
Kevin Boyd (he/him) 馃嚚馃嚘
Lennart Hengstmengel
Mykl Wynntrs